Add administrator sign-in and private-safe room directory

Connect personal operator-provisioned admin keys, persisted roles and eight-hour sessions, current/all-session revocation and a filtered room directory. Additive schema protects final owner, revokes disabled accounts and records safe audit history. No game state changes; remaining administration scope stays explicit.

Verified: typecheck, lint, 5196 offline tests, 52 HTTP tests, production build; authenticated local HTTP and desktop/mobile browser checks. Independent privacy/security review fixed malformed nested roster searches and read-time session revocation. Preserved 1,671 prior rooms and 3,538 seats. Container/deployed acceptance follows publication.

lib/admin-directory.ts

@@ -0,0 +1,22 @@
+/** Public operational metadata only; never a player view or a saved game. */
+export type AdminRoom = {
+  code: string;
+  version: number;
+  updatedAt: number;
+  status: 'lobby' | 'setup' | 'playing' | 'finished' | 'unreadable';
+  host: string | null;
+  players: { id: string; name: string; faction: string; control: 'human' | 'ai' | 'autopilot' }[];
+  advanced: boolean;
+  preview: boolean;
+  expansions: string[];
+  modules: string[];
+  turn: number | null;
+  phase: string;
+  pending: { label: string; owners: string[] };
+};
+export type AdminDirectory = {
+  rooms: AdminRoom[];
+  total: number;
+  page: number;
+  pageSize: number;
+};