IP allowlist and access rules

Use allowlists to control who can access admin tools.

Steps:
- Collect IPs for staff
- Add them to the firewall allowlist
- Test access before removing old IPs

Avoid allowlisting public IPs without verification.