feat(admin): build admin app foundation

Summary

Establish the foundation for admin.us-rse.org — workspace, auth posture, role/permission model, audit infrastructure, and frontend shell that every later admin subsystem inherits without rework. Spec lives at docs/superpowers/specs/2026-05-09-admin-app-foundation-design.md.

Requirements

• Extract packages/auth-shell from apps/web (AuthKit provider, env-check guard, root error boundary, useApi fetch wrapper). Public app continues to work unchanged.
• Schema: add staff to user_role enum, backfill WHERE role = 'admin', deprecate admin in a follow-up rev.
• packages/api/src/lib/policies/ directory with canEnterAdminApp, canApproveVocab, canMergeUsers, canEditGroup, canEditEvent, canViewAuditLog + Vitest tests.
• requireActorContext middleware: walk merge chain to canonical user, load leadership terms + chair memberships, populate c.var.actor. Returns 403 if canEnterAdminApp fails.
• requirePolicy(policy, scopeFn) middleware factory. Mount admin entry gate on the /api/admin/* sub-app.
• auditMiddleware afterware: write one audit_log row per mutating admin request. Handlers enrich payload via c.var.auditPayload and c.var.auditCapture(prior).
• GET /api/admin/me — returns { user, systemTier, positions: { leadership, chairedGroups, chairedEvents } }.
• GET /api/admin/audit — cursor-paginated audit reader, filterable by actor / action / targetType / targetId / date range, super_admin only.
• apps/admin workspace: Vite + React 19 + React Router 7 + design-system tokens. Mirrors apps/web patterns. Vite dev proxy /api → :8787.
• Admin shell: sidebar (numbered nav, adaptive per useNavSections()), top bar, dashboard tiles, audit page, stub routes for every future subsystem.
• Cloudflare Pages project us-rse-admin with admin.us-rse.org custom domain + _redirects for /api/* and SPA fallback.
• .github/workflows/deploy-admin.yml with path filters on apps/admin/**, packages/auth-shell/**, packages/design-system/**.
• WorkOS redirect URIs registered for admin.us-rse.org/auth/callback + preview pattern.
• Foundation tests: policy unit tests, audit middleware integration test, one end-to-end sign-in smoke.

Context

Spec was the result of a /superpowers:brainstorming session that decomposed the broader admin-app idea into a foundation plus ten follow-up subsystems. The foundation is intentionally feature-light — it ships the cross-cutting infrastructure so each subsystem (members, vocab, organizations, groups, events, recognition, forms, elections, communications, operations) lands on a stable target.

Implementation Notes

• Same WorkOS project for both SPAs; admin gate is a role check, not an auth-system check.
• Same Worker for both /api/* and /api/admin/*; sub-app pattern keeps the boundary obvious in code reviews.
• Code-defined policies, not data-defined. Auth changes are PR-reviewed and shipped.
• Audit middleware captures every mutating request automatically; handlers can opt into before/after diffs for irreversible-feeling actions.

Start with the linked design spec, then inspect apps/web, packages/api, packages/auth-shell, and the planned apps/admin workspace. Run the existing project tests before implementing the listed policy, audit, API, frontend, deployment, and workflow requirements. Done means the checklist is complete and the policy, audit integration, and sign-in smoke tests pass.