In the real site this is Firebase Auth with exactly one account — madelynfr@protonmail.com. The security rules name her user ID directly, so nobody else can write to the shop even if they somehow make an account. Her password is set once in the Firebase console and is deliberately not stored anywhere in this code.