Provisioning

Add venues, print tag sheets and QR codes, and open a staff console.

The password is ADMIN_SECRET, read from web/.env.local first, then .env. Never from .env.example — that one is only a template.