Reapply "Add missing admin action files and navigation links"

This reverts commit 4d515bc400.

src/lib/auth.ts

@@ -23,12 +23,18 @@ async function verify2faCode(userId: number, code: string): Promise<boolean> {
     if (!appKey) throw new Error("APP_KEY not configured");
     const secret = new LaravelEncrypter(appKey).decrypt(user.twoFactorSecret);
     if (verifyTotp(code, secret)) return true;
-  } catch { /* fall through to recovery */ }
+  } catch {
+    /* fall through to recovery */
+  }
 
   // Try recovery codes
   if (user.twoFactorRecoveryCodes) {
     let codes: string[];
-    try { codes = JSON.parse(user.twoFactorRecoveryCodes) as string[]; } catch { return false; }
+    try {
+      codes = JSON.parse(user.twoFactorRecoveryCodes) as string[];
+    } catch {
+      return false;
+    }
     const idx = codes.indexOf(code);
     if (idx !== -1) {
       codes.splice(idx, 1);
@@ -67,11 +73,9 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
         const user = await prisma.user.findUnique({ where: { username } });
         if (!user) {
           // Prevent timing-based enumeration: always run a dummy hash check.
-          await checkLogin(
-            password,
-            "$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd",
-            { convertPasswords: false },
-          );
+          await checkLogin(password, "$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd", {
+            convertPasswords: false,
+          });
           return null;
         }