chore(harness): make repository agent-ready

Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.

apps/admin/AGENTS.md

@@ -0,0 +1,14 @@
+# Admin application
+
+Vite/React administration UI. Use existing layout, route, and Supabase client
+patterns before introducing abstractions.
+
+- `pack_creator` manages permitted content; `super_admin` can access privileged
+  user/admin/audit surfaces.
+- Enforce role checks in both route visibility and the backend/RLS boundary.
+- Administrative mutations must remain auditable.
+- Use `.maybeSingle()` when zero rows are valid.
+- Never expose credentials, tokens, or private user content unnecessarily.
+- Add accessible labels and a focused test for changed behavior.
+- Verify with `npm run lint -w @sauci/admin`, `npm run typecheck -w
+  @sauci/admin`, and `npm run build -w @sauci/admin`.

apps/admin/agents.md

@@ -1,84 +0,0 @@
-# Admin Dashboard - Agent Guidelines
-
-**STRICT RULES - DO NOT VIOLATE**
-
-## Architecture
-
-This is a React Admin dashboard using:
-- **Build**: Vite
-- **Routing**: react-router-dom with component-based routing in `App.tsx`
-- **Styling**: Tailwind CSS
-- **State**: React Context (`AuthContext`)
-- **Backend**: Supabase client in `src/lib/supabase.ts`
-
-## Directory Structure
-
-```
-src/
-  components/           # Reusable components
-    layout/             # AppLayout, Sidebar, etc.
-    ProtectedRoute.tsx  # Route guard
-  contexts/             # React contexts (AuthContext)
-  hooks/                # Custom hooks
-  lib/                  # Utilities (supabase)
-  pages/                # Page components
-    content/            # Categories, Packs, Questions
-    users/              # User management (super_admin only)
-    admins/             # Admin management (super_admin only)
-```
-
-## Critical Rules
-
-### Authentication & Authorization
-
-Two admin roles exist:
-- `admin` - Content management only (categories, packs, questions)
-- `super_admin` - Full access including user data, admins, audit logs
-
-Use `<ProtectedRoute requireSuperAdmin>` for super_admin-only routes.
-
-### Route Structure
-
-```typescript
-// Public
-/login
-
-// Protected (all admins)
-/                       # Dashboard
-/categories             # Category management
-/categories/:id/packs   # Packs in category
-/packs/:id/questions    # Questions in pack
-
-// Protected (super_admin only)
-/users                  # User list
-/users/:id              # User detail
-/users/:id/matches/:id  # Match chat view
-/admins                 # Admin management
-/audit-logs             # Audit log viewer
-```
-
-### Supabase Queries
-
-- **Always use `.maybeSingle()` instead of `.single()`** when the row might not exist
-- All admin operations are audited - check `audit_logs` table structure
-
-### UI Patterns
-
-- Use Tailwind CSS for styling
-- Follow existing component patterns in `src/components/`
-- Use `AppLayout` wrapper for all protected pages
-
-### Security
-
-- Never expose user passwords or sensitive data in admin views
-- Audit log all administrative actions
-- Verify admin role before performing operations
-
-## Forbidden Actions
-
-1. **DO NOT** expose user passwords or auth tokens
-2. **DO NOT** allow content admins to access user data
-3. **DO NOT** bypass role checks in protected routes
-4. **DO NOT** perform destructive operations without confirmation
-5. **DO NOT** use `.single()` for queries that might return 0 rows
-6. **DO NOT** skip audit logging for administrative actions

apps/admin/package.json

@@ -4,9 +4,11 @@
     "private": true,
     "type": "module",
     "scripts": {
-        "dev": "vite",
-        "build": "vite build",
-        "typecheck": "tsc --noEmit",
+        "dev": "vite",
+        "build": "vite build",
+        "lint": "tsc --noEmit",
+        "test": "vitest run --passWithNoTests",
+        "typecheck": "tsc --noEmit",
         "preview": "vite preview"
     },
     "dependencies": {