Use plain admin password and remove operator email alerts; admin dashboard is the queue

app.py

@@ -5,7 +5,6 @@ from email.message import EmailMessage
 from pathlib import Path
 
 from flask import Flask, request, render_template, redirect, url_for, flash, session, send_from_directory, abort, current_app
-from werkzeug.security import check_password_hash, generate_password_hash
 from werkzeug.utils import secure_filename
 
 from config import Config
@@ -33,6 +32,9 @@ def require_admin():
     if not is_admin():
         return redirect(url_for('admin_login'))
 
+def admin_password_ok(pw):
+    return pw and pw == current_app.config['ADMIN_PASSWORD']
+
 def allowed_file(filename):
     return '.' in filename and filename.rsplit('.', 1)[1].lower() in current_app.config['ALLOWED_EXTENSIONS']
 
@@ -120,17 +122,9 @@ def approve(token):
 
     update_request(req['id'], customer_approved=choice, status='awaiting_payment', approval_notified_at=now_utc())
 
-    # alert operator
-    alert_to = current_app.config['ADMIN_ALERT_EMAIL'] or current_app.config['SMTP_FROM']
-    if alert_to:
-        admin_link = f"{current_app.config['PUBLIC_BASE_URL']}/admin/request/{req['id']}"
-        version_label = {'a': 'A', 'b': 'B', 'both': 'Both'}[choice]
-        body = f"{req['name']} ({req['email']}) approved: Version {version_label}.\n\nRequest #{req['id']}\nPayment is now due.\n\nOpen admin: {admin_link}"
-        try:
-            send_email(alert_to, f"{req['name']} approved their theme song", body)
-        except Exception as e:
-            flash(f'Approval saved, but operator alert failed: {e}', 'warning')
-            return redirect(url_for('play', token=token))
+    # alert operator (disabled — admin dashboard is the queue)
+    # alert_to = current_app.config['ADMIN_ALERT_EMAIL'] or current_app.config['SMTP_FROM']
+    # if alert_to: ...
 
     flash('Thanks! Please return to the booth to finalize payment.', 'success')
     return redirect(url_for('play', token=token))
@@ -143,17 +137,9 @@ def revise(token):
     note = request.form.get('revision_note', '').strip()
     update_request(req['id'], revision_note=note, status='songs_uploaded')
 
-    alert_to = current_app.config['ADMIN_ALERT_EMAIL'] or current_app.config['SMTP_FROM']
-    if alert_to and note:
-        admin_link = f"{current_app.config['PUBLIC_BASE_URL']}/admin/request/{req['id']}"
-        body = f"{req['name']} ({req['email']}) requested changes for request #{req['id']}.\n\nNote:\n{note}\n\nOpen admin: {admin_link}"
-        try:
-            send_email(alert_to, f"{req['name']} requested changes", body)
-        except Exception as e:
-            flash(f'Revision saved, but operator alert failed: {e}', 'warning')
-            return redirect(url_for('play', token=token))
-
-    flash('Your feedback has been sent. We will regenerate and update you.', 'success')
+    # Revision feedback is stored in the DB and surfaced on the admin dashboard.
+    # No operator email is sent — the dashboard is the single queue.
+    flash('Your feedback has been saved. We will regenerate and update you.', 'success')
     return redirect(url_for('play', token=token))
 
 @app.route('/audio/<token>/<version>.mp3')
@@ -176,14 +162,10 @@ def admin_login():
     if is_admin():
         return redirect(url_for('admin_dashboard'))
     if request.method == 'POST':
-        pw_hash = current_app.config['ADMIN_PASSWORD_HASH']
-        if not pw_hash:
-            flash('Admin password is not configured.', 'error')
-        elif check_password_hash(pw_hash, request.form.get('password', '')):
+        if admin_password_ok(request.form.get('password', '')):
             session['admin'] = True
             return redirect(url_for('admin_dashboard'))
-        else:
-            flash('Invalid password.', 'error')
+        flash('Invalid password.', 'error')
     return render_template('admin/login.html')
 
 @app.route('/admin/logout')