4 commits

Author	SHA1	Message	Date
Arlind Ukshini	107284801b	add hidden /fenjaops admin page (read-only) + is_admin invite flag ... - new is_admin column on invites (migration 4) with DEFAULT 0 - requireAdmin middleware returns 404 for non-admins so the route's existence isn't leaked; path obscured as /fenjaops (not /admin) - admin/ dir lives outside public/ and protected/; only reachable via the explicit gated mount + /api/fenjaops/{invites,joins} endpoints - bin/invite.js gains `admin add|remove|list` subcommands - OPERATIONS.md + CLAUDE.md + PROJECT.md document the hidden URL Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-23 17:29:19 +02:00
Arlind Ukshini	88863183e1	update docs: minimal env, WSL deploy, join tracking, rsync excludes ... - align auth docs with the simplified POST /auth/login flow - drop CODE_PEPPER / SMTP / MAIL_FROM / mail.js / request-code references - document the bifrost_joins table and bin/joins.js CLI - OPERATIONS.md: WSL setup, exclude data/.env/node_modules on promote rsync - INSTALL.md: 3-value /etc/fenja/env, drop SMTP prereq Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-23 17:10:08 +02:00
Arlind Ukshini	d5f578a581	update docs	2026-04-23 15:00:53 +02:00
Arlind Ukshini	bb5711c08e	Add CLAUDE.md with architecture and security invariants for AI agents ... Points to existing PROJECT/OPERATIONS/INSTALL/CHECKLIST docs rather than duplicating them, and surfaces the non-obvious bits: middleware ordering, auth flow, and the invariants that must not be broken silently.	2026-04-22 15:31:18 +02:00