Open a dashboard session from a password or a scoped token.

The session cookie wraps exactly the principal and scope the credential carried; a viewer token can never log into an operator session. Every attempt -- success or failure -- is journaled as a signed governance decision (dashboard.login).