Reapply "Add missing admin action files and navigation links"

This reverts commit 4d515bc400.

scripts/apply-migrations.ts

@@ -41,9 +41,7 @@ async function getApplied(): Promise<Set<string>> {
   const mysql = await import("mysql2/promise");
   const conn = await mysql.createConnection(url);
   try {
-    const [rows] = await conn.execute(
-      `SELECT migration FROM \`${TRACKING_TABLE}\` ORDER BY id`,
-    );
+    const [rows] = await conn.execute(`SELECT migration FROM \`${TRACKING_TABLE}\` ORDER BY id`);
     return new Set((rows as { migration: string }[]).map((r) => r.migration));
   } catch {
     return new Set();
@@ -79,10 +77,7 @@ async function apply(migration: MigrationFile): Promise<void> {
       await conn.execute(stmt);
     }
 
-    await conn.execute(
-      `INSERT INTO \`${TRACKING_TABLE}\` (migration) VALUES (?)`,
-      [migration.id],
-    );
+    await conn.execute(`INSERT INTO \`${TRACKING_TABLE}\` (migration) VALUES (?)`, [migration.id]);
     console.log(`[migrate] Applied: ${migration.name}`);
   } finally {
     await conn.end();

scripts/migrate-aes-cbc-to-gcm.ts

@@ -29,7 +29,9 @@ function decryptCbc(payload: string, key: Buffer, serialize = true): string {
     value: string;
     mac: string;
   };
-  const expected = createHmac("sha256", key).update(json.iv + json.value).digest("hex");
+  const expected = createHmac("sha256", key)
+    .update(json.iv + json.value)
+    .digest("hex");
   const a = Buffer.from(expected, "hex");
   const b = Buffer.from(json.mac, "hex");
   if (a.length !== b.length || !timingSafeEqual(a, b)) {
@@ -59,8 +61,8 @@ function isAlreadyGcm(payload: string, key: Buffer): boolean {
   try {
     const json = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
     if (!json.tag && !json.mac) return false; // can't determine format
-    if (json.tag) return true;                  // has authTag => GCM
-    return false;                               // has mac => CBC
+    if (json.tag) return true; // has authTag => GCM
+    return false; // has mac => CBC
   } catch {
     return false;
   }