Restrict Who Can See List of People in Prod

At present, a non-admin person can see the complete list of people who have authenticated with `auth` on our `test` version: https://dwylauth.herokuapp.com/people


This is a _useful_ feature during development because we can immediately see who has logged in & when. but ...
It's _obviously_ undesirable as it's "leaking" Personally Identifiable Information ([PII](https://github.com/dwyl/fields/issues/87))
Even though this is a Test System, we still don't want to let _anyone_ see who has authenticated.
So I propose we restrict the data visible in this view to only the **`admin`** of the App and **`superadmin`**.

Start by tracing the /people view in the test auth deployment and identify how access is currently checked. Confirm the existing admin and superadmin roles, then verify that other users cannot see the authenticated people list while those roles still can. Done means the PII is no longer exposed at /people.

Written by the indexing model from the issue text.