Deployment access key + password required
Unique secret per deployment (not a YubiKey). Store only on the server; optional "remember on this device" keeps it in browser storage for convenience.