Phase 1
This admin surface runs through a server-side BFF. Browser requests never call protected backend /admin/* routes directly.