- /login sends a Supabase magic link (admin emails only); /auth/confirm
completes sign-in; proxy.ts guards /admin and every server action
re-checks with requireAdmin(), since actions are plain POST endpoints.
- /admin lists, creates, duplicates and deletes events.
- /admin/events/[eventId] edits teams (colour, order) and games with
criteria, presets and notes. All input goes through zod schemas that
mirror the database constraints so errors read as plain sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Next.js 16 App Router with strict TypeScript, Tailwind 4 theme tokens from
docs/UI.md, Vitest, and the three Supabase clients. Env vars are validated
with zod in next.config.ts so dev and build fail fast with a readable error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
joshuaandClaude Opus 5.5