PII: admin-only. Access is enforced by is_admin_email_allowlist() in the database (migration 016); keep the client allowlist in auth-ui in sync. Deploy migrations 016–020. Login history uses login_events via Edge Function record-login-event. Admin ops email (IP/geo): every app session emails admins only (not the customer); first session for a new account is labeled Registration. Pro/trial purchase uses the same Edge URL with admin_activity: subscription. See .env.example.