Add administrator sign-in and private-safe room directory

Connect personal operator-provisioned admin keys, persisted roles and eight-hour sessions, current/all-session revocation and a filtered room directory. Additive schema protects final owner, revokes disabled accounts and records safe audit history. No game state changes; remaining administration scope stays explicit.

Verified: typecheck, lint, 5196 offline tests, 52 HTTP tests, production build; authenticated local HTTP and desktop/mobile browser checks. Independent privacy/security review fixed malformed nested roster searches and read-time session revocation. Preserved 1,671 prior rooms and 3,538 seats. Container/deployed acceptance follows publication.

app/api/admin/rooms/route.ts

@@ -0,0 +1,11 @@
+import { env } from 'cloudflare:workers';
+import { requireAdmin } from '@/db/admin-access';
+import { readAdminDirectory } from '@/db/admin-directory';
+import { adminFailure, adminResponse, adminToken } from '@/lib/admin-http';
+
+export async function GET(request: Request) {
+  try {
+    const identity = await requireAdmin(env.DB, adminToken(request), ['owner', 'operator', 'viewer']);
+    return adminResponse(await readAdminDirectory(env.DB, identity, new URL(request.url).searchParams));
+  } catch (error) { return adminFailure(error); }
+}

app/api/admin/session/route.ts

@@ -0,0 +1,24 @@
+import { env } from 'cloudflare:workers';
+import { AdminError, adminLogin, adminLogout, adminLogoutAll, requireAdmin } from '@/db/admin-access';
+import { adminBody, adminCookie, adminFailure, adminResponse, adminToken } from '@/lib/admin-http';
+
+export async function GET(request: Request) {
+  try {
+    const { id, name, role } = await requireAdmin(env.DB, adminToken(request));
+    return adminResponse({ admin: { id, name, role } });
+  } catch (error) { return adminFailure(error); }
+}
+export async function POST(request: Request) {
+  try {
+    const body = await adminBody(request, env.DUNE_PUBLIC_ORIGIN);
+    if (body.action === 'login' && Object.keys(body).every(k => ['action', 'key'].includes(k))) {
+      const result = await adminLogin(env.DB, body.key);
+      return adminResponse({ admin: result.admin }, { 'Set-Cookie': adminCookie(request, result.token, env.DUNE_PUBLIC_ORIGIN) });
+    }
+    if (Object.keys(body).length !== 1) throw new AdminError('Invalid session action.', 400);
+    if (body.action === 'logout') await adminLogout(env.DB, adminToken(request));
+    else if (body.action === 'logoutAll') await adminLogoutAll(env.DB, await requireAdmin(env.DB, adminToken(request)));
+    else throw new AdminError('Choose a valid session action.', 400);
+    return adminResponse({ signedOut: true }, { 'Set-Cookie': adminCookie(request, '', env.DUNE_PUBLIC_ORIGIN) });
+  } catch (error) { return adminFailure(error); }
+}