Accounts & roles
Customers self-signup with a real password policy and hashed, single-use reset links staged in a mail outbox. Admin, staff and customer see three different systems behind one login, RBAC enforced server-side, citext-unique emails.