- /login sends a Supabase magic link (admin emails only); /auth/confirm
completes sign-in; proxy.ts guards /admin and every server action
re-checks with requireAdmin(), since actions are plain POST endpoints.
- /admin lists, creates, duplicates and deletes events.
- /admin/events/[eventId] edits teams (colour, order) and games with
criteria, presets and notes. All input goes through zod schemas that
mirror the database constraints so errors read as plain sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
