[Admin][UI] SPA scaffold — auth gate, shell, navigation

[serge-ivo]

[Admin][UI] SPA scaffold — auth gate, shell, navigation

Why

The admin app (from the Infra issue) needs its shell before feature pages land.

Scope

• App shell: 48px header (match console), left/top nav, dark theme, shared design tokens.
• Auth gate: on load call GET /v1/admin/me; if not admin show a clean "Admin access required" state; if signed out, link to /console/ sign-in. Read session from the same localStorage token the console uses.
• Central apiFetch wrapper (Bearer token + error handling), mirroring console.
• Nav routes (stubs, filled by later issues): Overview · Users · Agents & Instances · Usage & Spending · Errors & Ops · Moderation.
• Mobile-friendly (the store convention: icon nav, scrollable).

Acceptance criteria

• Admin sees the shell + empty routed pages; non-admin sees the gate; signed-out sees sign-in prompt.
• Client-side routing works on deep links (pairs with host serving).
• Shares fonts/tokens/dark mode with console.

Relevant code

• store/admin/ (new app), reference store/console/src/ (apiFetch, nav, header)

References

• FGS App.tsx router + auth gate; FAS App.tsx.

Part of the PAGS Admin Portal epic. Depends on Infra + Foundation. Blocks the other UI issues.

[serge-ivo]

Decision (2026-08-01): CF Access perimeter is deferred to land WITH this UI. When building #35, also: (1) create the Access self-hosted app for api.proagentstore.online/v1/admin + a service token so the SPA can call the admin API without a 302→login/CORS break, (2) set CF_ACCESS_TEAM_DOMAIN + CF_ACCESS_AUD in wrangler.toml [vars] + deploy. The gate (lib/cf-access.ts) is already inert-until-configured. Order matters: create the app FIRST, then set the vars (setting vars with no app = 403 lockout).

[serge-ivo]

Done — React 19 + Tailwind v4 + Vite SPA with auth gate (GET /v1/admin/me: anon→sign-in, non-admin→denied, admin→portal), hash-routed shell + nav. Landed as 7db2599. (CF Access perimeter still deferred per the note above.)