Add administrator sign-in and private-safe room directory

Connect personal operator-provisioned admin keys, persisted roles and eight-hour sessions, current/all-session revocation and a filtered room directory. Additive schema protects final owner, revokes disabled accounts and records safe audit history. No game state changes; remaining administration scope stays explicit.

Verified: typecheck, lint, 5196 offline tests, 52 HTTP tests, production build; authenticated local HTTP and desktop/mobile browser checks. Independent privacy/security review fixed malformed nested roster searches and read-time session revocation. Preserved 1,671 prior rooms and 3,538 seats. Container/deployed acceptance follows publication.

README.md

@@ -39,6 +39,11 @@ For private NAS hosting and manually applied checkpoint image updates, see the
 [TrueNAS container guide](docs/TRUENAS.md). Its separate persistent storage starts
 with new games; the requested host port is 33046.
 
+The **Administration** link opens `/admin`, with separate administrator sign-in,
+session controls and a searchable room directory. See [initial owner setup and
+scope](docs/ADMIN_PANEL.md#initial-owner-and-access-recovery). Room creation,
+lifecycle/removal, participant support and backup tools are still being built.
+
 ## Saved seats and reconnecting
 
 The room cookie identifies your seat. Refreshing or reopening the invitation with that cookie restores your private hand and pending decisions. A failed restoration offers an explicit retry. Requests time out after 15 seconds; uncertain game actions are reconciled with a read rather than automatically repeated.