Note: this page checks the username/password against a Firestore document, which keeps things simple but is not the same as full account security — anyone who can read your admin collection could see the stored password. Lock down read/write access to admin/* in your Firestore security rules so only your own signed-in admin session (or none, from the public client) can read it.