Break-glass emergency access

Two-person rule: one admin opens a request, a second distinct admin must approve before sensitive export is unlocked. Currently acting as Bill Olson.