Production sign-in is UNICEF's Microsoft/Azure AD SSO (spec section 3) — no separate password. This dev build swaps that for a role picker that mints the same session.