The shared staff passphrase is a BACKUP. One secret admits everybody and names nobody in the audit log. Turn OPERATOR_PASSPHRASE_FALLBACK off once email sign-in is proven.

You also need a row in the operator registry. Being in the directory is not enough, on purpose — ask an admin to add you.