Build Back Office admin shell and navigation UI

[yacosta738]

Context

Back Office needs a coherent operational surface rather than a set of disconnected admin endpoints. The first UI slice should establish the admin shell, routing, and navigation structure without forcing every screen to ship at once.

Goal

Create the initial Back Office admin shell and navigation structure.

Scope

• Add the /admin route.
• Establish initial admin navigation.
• Provide the layout and routing seams for overview, users, waitlist, invitations, notifications, governance, configuration, and audit log screens.
• Enforce frontend access gating consistent with server-side authorization.

Out of Scope

• Implementing every admin screen in this issue.
• Treating frontend guards as the only authorization mechanism.
• Dashboard vanity analytics.

Domain Rules

• Back Office UI is a client of admin APIs.
• UI must not imply permissions the API does not enforce.

API Contract

• Consumes existing admin APIs; does not redefine their semantics.

Security

• Frontend gating is additive, not authoritative.
• Sensitive data should not be rendered unless provided by authorized APIs.

Audit

• Navigation itself is not an auditable mutation.

Observability

• Basic page access telemetry may be added if already consistent with frontend observability conventions.

Acceptance Criteria

1. /admin route exists.
2. Initial admin layout and navigation are available.
3. Navigation exposes the planned Back Office areas without requiring every screen to be complete.
4. Frontend gating aligns with server-side authorization behavior.

Gherkin

Feature: Back Office admin shell

  Scenario: Open Back Office
    Given an authorized administrator
    When the administrator opens /admin
    Then the Back Office shell should load
    And the initial admin navigation should be visible

Testing

• Frontend
• Integration
• E2E

Dependencies

• Establish administrative authorization boundary for Back Office APIs #659

References

• RFC sections 32, 33, 37, 45

[linear-code]

DALLAY-573