- cja_admin + cja_admin_log tables (dedicated single-admin tier + audit trail)
- AdminAuth controller: /api/adminauth login/logout/me, session-based,
rate-limited, every attempt logged
- set-admin-password CLI (bcrypt, run manually so the password never enters
an agent context)
- requireAdmin() guard for future privileged console endpoints
- agent env scaffold (git-ignored)
Foundation only — no agent runner or features yet. Preview/publish, media,
and the dashboard come in phases 1-3 per agents/console/PLAN.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a
