Admin sign-in via backend-brokered Keycloak session