Record the M10 plan and correct the admin-scope contract:
- §1: narrow the app's exclusion list. The operational admin subset is now
IN scope for staff (moderation, support queue, dashboard/site-mode, content =
news posts + wiki cats/tags). Only the hero/CMS block editor, Discord-bot
config, uo-link config, and OAuth-provider setup remain excluded.
- §6.4: self-service stays role-agnostic under /auth/me/*, but the operational
admin subset now calls /api/v1/admin/** directly, gated by a STAFF/ADMIN menu
access level; bearer is accepted and role re-checked every request.
- §9: add milestone M10 covering the SSO discovery/reachability fixes (native
buttons, no website fallback, encrypted pending PKCE, scrollable drawer, dev
stub IdP) and the staff-operations screens.
Co-Authored-By: Claude <noreply@anthropic.com>
wtclaude
e50c6dda2c