! Role-based PIN login — Each role has a separate PIN.
Default PINs are set in ROLE_PINS — change before production rollout.