Where a staff sign-in lands: a bank host's own bank; on the apex the bank
they entered last, else selectedWorkspaceId. null when none of those
is one they may enter.
The host's bank domain; null on the apex.
The workspace cookie's value, untrusted.
Records one row in one statement: SIGNED_IN while a sign-in is pending, else ENTERED_WORKSPACE.
The actor's distinct bank workspaces, newest entry first, that they may still enter: for a member an enabled workspace and a live ACTIVE membership, for CFX staff any bank's.
The bank dashboard's sign-in and workspace-entry history.