vibeprop admin

Served by the admin Worker. Same BFF shape, separate deployable. The API enforces the admin role regardless of which surface called it.

Session

Probe

Content id

Call	Status	Body

The token arrives as ?_mock=… and is exchanged for a session server-side — the browser never holds a credential (ADR-009). Refused outside local. Styled entirely from @vibeprop/theme.