feat(admin): reorganize housekeeping and strengthen shared workflows

src/app/admin/devops/cms-errors/page.tsx

@@ -1,4 +1,5 @@
 import { redirect } from "next/navigation";
+import { getTranslations } from "next-intl/server";
 import Link from "@/components/link";
 import { ErrorStore } from "@/lib/error-monitor";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
@@ -11,6 +12,7 @@ export default async function CmsErrorsPage({
 	const { session, permissions } = await getAdminContext();
 	if (!canAccess(permissions, PERMS.DEVOPS_VIEW, session.user.rank))
 		redirect("/admin");
+	const t = await getTranslations("pages.admin.cmsErrors");
 	const params = await searchParams;
 	const query = (params.q ?? "").trim().slice(0, 200).toLowerCase();
 	let result: Awaited<ReturnType<ErrorStore["read"]>>;
@@ -19,14 +21,15 @@ export default async function CmsErrorsPage({
 	} catch {
 		return (
 			<div className="admin-card" role="alert">
-				Error storage could not be read. Check the CMS storage volume and
-				permissions.
+				{t("storageError")}
 			</div>
 		);
 	}
 	const filtered = result.records.filter(
 		(r) =>
 			(!params.source || r.source === params.source) &&
+			(params.status !== "open" || !r.resolved) &&
+			(params.status !== "resolved" || r.resolved) &&
 			(!query || JSON.stringify(r).toLowerCase().includes(query)),
 	);
 	const groups = new Map<string, typeof filtered>();
@@ -43,62 +46,62 @@ export default async function CmsErrorsPage({
 		),
 	);
 	const pageHref = (next: number) =>
-		`?${new URLSearchParams({ q: params.q ?? "", source: params.source ?? "", page: String(next) })}`;
+		`?${new URLSearchParams({ q: params.q ?? "", source: params.source ?? "", status: params.status ?? "", page: String(next) })}`;
 	return (
 		<div className="space-y-5">
 			<div>
-				<h1 className="text-2xl font-semibold">CMS error center</h1>
-				<p className="text-muted-foreground">
-					Server and browser errors from the last 7 days. Browser reports are
-					unverified client observations.
-				</p>
+				<h1 className="text-2xl font-semibold">{t("title")}</h1>
+				<p className="text-muted-foreground">{t("subtitle")}</p>
 			</div>
 			<div className="flex flex-wrap gap-3">
 				<Link href="/admin/devops" className="btn btn-outline">
 					DevOps
 				</Link>
 				<Link href="/admin/devops/errors" className="btn btn-outline">
-					Emulator errors
+					{t("emulator")}
 				</Link>
 				<Link href="/admin/devops/cms-errors" className="btn btn-outline">
-					Refresh / clear filters
+					{t("refresh")}
 				</Link>
 			</div>
 			<form className="admin-card flex flex-wrap gap-3">
 				<input
-					aria-label="Search errors"
+					aria-label={t("search")}
 					name="q"
 					defaultValue={params.q}
-					placeholder="Reference, digest, message, route or release"
+					placeholder={t("searchHint")}
 					className="input min-w-0 flex-1"
 				/>
 				<select
 					name="source"
-					aria-label="Error source"
+					aria-label={t("source")}
 					defaultValue={params.source ?? ""}
 					className="input"
 				>
-					<option value="">All sources</option>
+					<option value="">{t("allSources")}</option>
 					<option value="server">Server</option>
 					<option value="browser">Browser</option>
 				</select>
+				<select
+					name="status"
+					aria-label={t("status")}
+					defaultValue={params.status ?? ""}
+					className="input"
+				>
+					<option value="">{t("allStatuses")}</option>
+					<option value="open">{t("open")}</option>
+					<option value="resolved">{t("resolved")}</option>
+				</select>
 				<button type="submit" className="btn btn-primary">
-					Search
+					{t("search")}
 				</button>
 			</form>
 			<p className="text-sm text-muted-foreground">
-				{filtered.length} occurrences · {groups.size} groups.{" "}
-				{result.truncated
-					? "Showing the latest 1,000 events. Narrowing filters searches this retained window."
-					: ""}{" "}
-				Storage is limited to 10 MB per day; excess events remain in server logs
-				where available.
+				{t("counts", { count: filtered.length, groups: groups.size })}{" "}
+				{result.truncated ? t("truncated") : ""} {t("retention")}
 			</p>
 			{groups.size === 0 ? (
-				<div className="admin-card">
-					No captured errors match these filters. Monitoring starts with this
-					deployment; older console logs are not imported.
-				</div>
+				<div className="admin-card">{t("empty")}</div>
 			) : null}
 			{[...groups.entries()]
 				.slice((page - 1) * 25, page * 25)
@@ -108,25 +111,24 @@ export default async function CmsErrorsPage({
 						<details key={fingerprint} className="admin-card overflow-hidden">
 							<summary className="cursor-pointer">
 								<span className="text-xs text-muted-foreground">
-									{r.resolved ? "Resolved" : "Open"} · {r.source} ·{" "}
-									{events.length} occurrences · {r.at}
+									{t(r.resolved ? "resolved" : "open")} · {r.source} ·{" "}
+									{t("occurrences", { count: events.length })} · {r.at}
 								</span>
 								<p className="font-semibold break-words">{r.event}</p>
 								<p className="text-sm break-words">{r.message}</p>
 							</summary>
 							<div className="mt-4 space-y-3 text-sm">
 								<p>
-									Reference: <code className="break-all">{r.id}</code>
+									{t("reference")}: <code className="break-all">{r.id}</code>
 								</p>
 								<p>
-									Release: <code className="break-all">{r.release}</code>
+									{t("release")}: <code className="break-all">{r.release}</code>
 								</p>
 								<pre className="whitespace-pre-wrap break-all rounded bg-muted p-3">
 									{JSON.stringify(r.context, null, 2)}
 								</pre>
 								<pre className="max-h-96 overflow-auto whitespace-pre-wrap break-all rounded bg-muted p-3">
-									{r.stack ||
-										"No stack supplied. Use the reference or digest to correlate server logs."}
+									{r.stack || t("noStack")}
 								</pre>
 								{!r.resolved &&
 								canAccess(permissions, PERMS.DEVOPS_EDIT, session.user.rank) ? (
@@ -137,16 +139,16 @@ export default async function CmsErrorsPage({
 											value={r.fingerprint}
 										/>
 										<button type="submit" className="btn btn-outline">
-											Mark resolved
+											{t("resolve")}
 										</button>
 										<p className="text-muted-foreground text-xs">
-											A new occurrence reopens the group automatically.
+											{t("reopenHint")}
 										</p>
 									</form>
 								) : null}
 								<details>
 									<summary className="cursor-pointer">
-										Occurrence references
+										{t("references")}
 									</summary>
 									<ul>
 										{events.map((e) => (
@@ -156,23 +158,20 @@ export default async function CmsErrorsPage({
 										))}
 									</ul>
 								</details>
-								<p className="text-muted-foreground">
-									Browser stack traces may reference compiled chunks. This view
-									does not infer a root cause or include request bodies.
-								</p>
+								<p className="text-muted-foreground">{t("stackHint")}</p>
 							</div>
 						</details>
 					);
 				})}
-			<nav aria-label="Error pages" className="flex gap-3">
+			<nav aria-label={t("pages")} className="flex gap-3">
 				{page > 1 ? (
 					<Link href={pageHref(page - 1)} className="btn btn-outline">
-						Previous
+						{t("previous")}
 					</Link>
 				) : null}
 				{page * 25 < groups.size ? (
 					<Link href={pageHref(page + 1)} className="btn btn-outline">
-						Next
+						{t("next")}
 					</Link>
 				) : null}
 			</nav>

src/app/admin/devops/page.tsx

@@ -57,7 +57,7 @@ export default async function DevOpsPage() {
 	return (
 		<div className="space-y-6">
 			<a href="/admin/devops/cms-errors" className="btn btn-outline">
-				CMS error center
+				{t("cmsErrors")}
 			</a>
 			{/* Status cards */}
 			<div className="grid gap-4 md:grid-cols-2 lg:grid-cols-5">

src/app/admin/layout.tsx

@@ -11,14 +11,9 @@ import { LanguageSwitcher } from "@/components/language-switcher";
 import Link from "@/components/link";
 import { ThemeSwitcher } from "@/components/theme-switcher";
 import { requireStaff } from "@/lib/admin/guard";
-import { collectNavPermissionSlugs } from "@/lib/admin-nav";
-import {
-	ADMIN_NAV_CONFIG_KEY,
-	parseAdminNavConfig,
-} from "@/lib/admin-nav-config";
+import { loadAdminNavigation } from "@/lib/admin/navigation";
 import { db, User } from "@/lib/db";
 import { readCsrfCookieToken } from "@/lib/foundation/security";
-import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { siteSettings } from "@/lib/services/site-settings";
 
 // Request-time auth, existing CSRF cookie, and optional 2FA gate cannot be
@@ -31,6 +26,7 @@ export default async function AdminLayout({
 	children: ReactNode;
 }) {
 	const staff = await requireStaff();
+	const navigation = await loadAdminNavigation();
 	const csrfToken = await readCsrfCookieToken();
 	if (await siteSettings.getBool("force_staff_2fa", false)) {
 		const u = await db
@@ -52,7 +48,7 @@ export default async function AdminLayout({
 					className="flex flex-col min-w-0 p-5 lg:p-6 min-h-full"
 					style={{ backgroundColor: "var(--admin-canvas)" }}
 				>
-					<AdminTopbar staff={staff} />
+					<AdminTopbar staff={staff} navigation={navigation} />
 					<section className="admin-page flex-1">
 						<AdminHubChrome>{children}</AdminHubChrome>
 					</section>
@@ -69,27 +65,8 @@ async function Sidebar({
 }) {
 	const t = await getTranslations("pages.admin.nav");
 	const initial = staff.username.charAt(0).toUpperCase();
-	const { permissions } = await getAdminContext();
-	const isSuperAdmin = permissions.isSuperAdmin;
-	const hasDashboard = canAccess(
-		permissions,
-		PERMS.ADMIN_DASHBOARD,
-		staff.rank,
-	);
-	// Super-admins see everything. Everyone else sees items their ACL grants.
-	// If they can open the admin panel but ACL is incomplete (common after HK→ACL
-	// migration gaps), still show *.view nav entries so categories do not vanish.
-	const allowedPermissions = isSuperAdmin
-		? []
-		: collectNavPermissionSlugs().filter((slug) => {
-				if (canAccess(permissions, slug, staff.rank)) return true;
-				if (!hasDashboard) return false;
-				return slug.endsWith(".view") || slug === PERMS.ADMIN_DASHBOARD;
-			});
-
-	const navConfig = parseAdminNavConfig(
-		await siteSettings.get(ADMIN_NAV_CONFIG_KEY, ""),
-	);
+	const { allowedPermissions, isSuperAdmin, navConfig } =
+		await loadAdminNavigation();
 
 	return (
 		<aside
@@ -118,6 +95,7 @@ async function Sidebar({
 			</div>
 
 			<AdminSidebarNav
+				userId={staff.id}
 				allowedPermissions={allowedPermissions}
 				isSuperAdmin={isSuperAdmin}
 				navConfig={navConfig}

src/app/admin/page.tsx

@@ -8,6 +8,7 @@ import {
 	Users,
 } from "lucide-react";
 import { getTranslations } from "next-intl/server";
+import { AdminWorkQueue } from "@/components/admin/admin-work-queue";
 import { StatusCard } from "@/components/admin/dashboard";
 import Link from "@/components/link";
 import { unixNow } from "@/lib/bans";
@@ -126,6 +127,7 @@ export default async function AdminDashboard() {
 				/>
 			</div>
 
+			<AdminWorkQueue />
 			<div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
 				<section className="admin-card p-5">
 					<h2 className="text-sm font-bold text-[var(--admin-text)] mb-4 admin-section-title">

src/app/admin/studio/sync/catalog-export-client.tsx

@@ -1,6 +1,7 @@
 "use client";
 
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useRef, useState } from "react";
+import { useVisiblePolling } from "@/hooks/use-visible-polling";
 import { adminFetch } from "@/lib/admin-fetch";
 
 import { CatalogGitConfiguration } from "./catalog-git-configuration";
@@ -25,7 +26,10 @@ export function CatalogExportClient({
 	const [status, setStatus] = useState<ExportStatus | null>(null);
 	const [error, setError] = useState("");
 	const [busy, setBusy] = useState(false);
+	const refreshing = useRef(false);
 	const refresh = useCallback(async () => {
+		if (refreshing.current) return;
+		refreshing.current = true;
 		try {
 			const response = await adminFetch("/api/admin/catalog-export", {
 				cache: "no-store",
@@ -35,15 +39,11 @@ export function CatalogExportClient({
 			setError("");
 		} catch {
 			setError("Unable to load export status");
+		} finally {
+			refreshing.current = false;
 		}
 	}, []);
-	useEffect(() => {
-		void refresh();
-		const timer = setInterval(() => {
-			void refresh();
-		}, 15_000);
-		return () => clearInterval(timer);
-	}, [refresh]);
+	useVisiblePolling(refresh, 15000);
 	async function retry() {
 		setBusy(true);
 		try {

src/app/admin/users/show/[id]/page.tsx

@@ -27,8 +27,10 @@ export default async function UserShowPage({
 	const t = await getTranslations("pages.admin.users.detail");
 	const canEdit = canAccess(permissions, PERMS.USERS_EDIT, session.user.rank);
 	const data = await loadUserById(id);
-	const sanctions = await loadUserSanctions(data.user.id);
-	const watched = await getWatchedUserIds(session.user.id);
+	const [sanctions, watched] = await Promise.all([
+		loadUserSanctions(data.user.id),
+		getWatchedUserIds(session.user.id),
+	]);
 
 	return (
 		<div className="space-y-6">
@@ -54,7 +56,7 @@ export default async function UserShowPage({
 				}
 			>
 				<Tabs defaultValue="info" className="space-y-4 min-w-0">
-					<TabsList>
+					<TabsList className="h-auto flex-wrap justify-start">
 						<TabsTrigger value="info">{t("tabInfo")}</TabsTrigger>
 						<TabsTrigger value="badges">
 							{t("tabBadges", { count: data.user.badges.length })}
@@ -75,7 +77,7 @@ export default async function UserShowPage({
 					<TabsContent value="badges">
 						<div className="rounded-lg border bg-card p-4">
 							<h3 className="text-sm font-semibold mb-3">
-								Badges ({data.user.badges.length})
+								{t("tabBadges", { count: data.user.badges.length })}
 							</h3>
 							<UserBadgesReadonly badges={data.user.badges} />
 						</div>

src/app/api/admin/search/route.ts

@@ -1,5 +1,6 @@
 import { eq, like, or } from "drizzle-orm";
 import { NextResponse } from "next/server";
+import { ADMIN_NAV_GROUPS, navItemIsAllowed } from "@/lib/admin-nav";
 import { apiOk } from "@/lib/api";
 import { withAdmin } from "@/lib/api-handler";
 import {
@@ -11,7 +12,7 @@ import {
 	WebsiteRareValues,
 	WebsiteShopArticles,
 } from "@/lib/db";
-import { PERMS } from "@/lib/permissions";
+import { canAccess, PERMS } from "@/lib/permissions";
 import { rateLimit } from "@/lib/rate-limit";
 
 export type AdminSearchResult = {
@@ -53,102 +54,130 @@ export const GET = withAdmin(
 			return apiOk({ results: [] });
 		}
 
+		const canSearch = (href: string) => {
+			const item = ADMIN_NAV_GROUPS.flatMap((group) => group.items).find(
+				(item) => item.href === href,
+			);
+			return (
+				!!item &&
+				navItemIsAllowed(item, {
+					isSuperAdmin: context.permissions.isSuperAdmin,
+					has: (slug) =>
+						canAccess(context.permissions, slug, context.session.user.rank),
+				})
+			);
+		};
+
 		const pattern = `%${escapeLike(q)}%`;
 		const idExact = Number.parseInt(q, 10);
 		const hasId = Number.isFinite(idExact) && String(idExact) === q;
 
 		const [users, articles, rooms, guilds, shopArticles, rareValues] =
 			await Promise.all([
-				db
-					.select({
-						id: User.id,
-						title: User.username,
-						subtitle: User.mail,
-					})
-					.from(User)
-					.where(
-						or(
-							like(User.username, pattern),
-							like(User.mail, pattern),
-							...(hasId ? [eq(User.id, idExact)] : []),
-						),
-					)
-					.limit(PER_TYPE),
+				canSearch("/admin/users")
+					? db
+							.select({
+								id: User.id,
+								title: User.username,
+								subtitle: User.mail,
+							})
+							.from(User)
+							.where(
+								or(
+									like(User.username, pattern),
+									like(User.mail, pattern),
+									...(hasId ? [eq(User.id, idExact)] : []),
+								),
+							)
+							.limit(PER_TYPE)
+					: Promise.resolve([]),
 
-				db
-					.select({
-						id: WebsiteArticles.id,
-						title: WebsiteArticles.title,
-						subtitle: WebsiteArticles.slug,
-					})
-					.from(WebsiteArticles)
-					.where(
-						or(
-							like(WebsiteArticles.title, pattern),
-							like(WebsiteArticles.slug, pattern),
-						),
-					)
-					.limit(PER_TYPE),
+				canSearch("/admin/articles")
+					? db
+							.select({
+								id: WebsiteArticles.id,
+								title: WebsiteArticles.title,
+								subtitle: WebsiteArticles.slug,
+							})
+							.from(WebsiteArticles)
+							.where(
+								or(
+									like(WebsiteArticles.title, pattern),
+									like(WebsiteArticles.slug, pattern),
+								),
+							)
+							.limit(PER_TYPE)
+					: Promise.resolve([]),
 
-				db
-					.select({
-						id: Rooms.id,
-						title: Rooms.name,
-						subtitle: Rooms.ownerName,
-					})
-					.from(Rooms)
-					.where(
-						or(
-							like(Rooms.name, pattern),
-							...(hasId ? [eq(Rooms.id, idExact)] : []),
-						),
-					)
-					.limit(PER_TYPE),
+				canSearch("/admin/rooms")
+					? db
+							.select({
+								id: Rooms.id,
+								title: Rooms.name,
+								subtitle: Rooms.ownerName,
+							})
+							.from(Rooms)
+							.where(
+								or(
+									like(Rooms.name, pattern),
+									...(hasId ? [eq(Rooms.id, idExact)] : []),
+								),
+							)
+							.limit(PER_TYPE)
+					: Promise.resolve([]),
 
-				db
-					.select({
-						id: Guilds.id,
-						title: Guilds.name,
-						subtitle: Guilds.description,
-					})
-					.from(Guilds)
-					.where(
-						or(
-							like(Guilds.name, pattern),
-							...(hasId ? [eq(Guilds.id, idExact)] : []),
-						),
-					)
-					.limit(PER_TYPE),
+				canSearch("/admin/guilds")
+					? db
+							.select({
+								id: Guilds.id,
+								title: Guilds.name,
+								subtitle: Guilds.description,
+							})
+							.from(Guilds)
+							.where(
+								or(
+									like(Guilds.name, pattern),
+									...(hasId ? [eq(Guilds.id, idExact)] : []),
+								),
+							)
+							.limit(PER_TYPE)
+					: Promise.resolve([]),
 
-				db
-					.select({
-						id: WebsiteShopArticles.id,
-						title: WebsiteShopArticles.name,
-						subtitle: WebsiteShopArticles.info,
-					})
-					.from(WebsiteShopArticles)
-					.where(
-						or(
-							like(WebsiteShopArticles.name, pattern),
-							...(hasId ? [eq(WebsiteShopArticles.id, BigInt(idExact))] : []),
-						),
-					)
-					.limit(PER_TYPE),
+				canSearch("/admin/shop")
+					? db
+							.select({
+								id: WebsiteShopArticles.id,
+								title: WebsiteShopArticles.name,
+								subtitle: WebsiteShopArticles.info,
+							})
+							.from(WebsiteShopArticles)
+							.where(
+								or(
+									like(WebsiteShopArticles.name, pattern),
+									...(hasId
+										? [eq(WebsiteShopArticles.id, BigInt(idExact))]
+										: []),
+								),
+							)
+							.limit(PER_TYPE)
+					: Promise.resolve([]),
 
-				db
-					.select({
-						id: WebsiteRareValues.id,
-						title: WebsiteRareValues.name,
-						subtitle: WebsiteRareValues.itemId,
-					})
-					.from(WebsiteRareValues)
-					.where(
-						or(
-							like(WebsiteRareValues.name, pattern),
-							...(hasId ? [eq(WebsiteRareValues.itemId, idExact)] : []),
-						),
-					)
-					.limit(PER_TYPE),
+				canSearch("/admin/rare-values")
+					? db
+							.select({
+								id: WebsiteRareValues.id,
+								title: WebsiteRareValues.name,
+								subtitle: WebsiteRareValues.itemId,
+							})
+							.from(WebsiteRareValues)
+							.where(
+								or(
+									like(WebsiteRareValues.name, pattern),
+									...(hasId ? [eq(WebsiteRareValues.itemId, idExact)] : []),
+								),
+							)
+							.limit(PER_TYPE)
+					: Promise.resolve([]),
 			]);
 
 		const groupMap: Record<