feat(09-01): implement separate-admin genre list tracer

- Audience-aware mint, verify, refresh, and backend guard keep frontend tokens compatible
- Cabana mounts raw admin login, list schema, and record list behind admin.jwt.secret
- Framework migration seeds Winter backend users and developer/publisher roles

lagoon/backend_admin_migrations.go

@@ -0,0 +1,67 @@
+package lagoon
+
+import (
+	"github.com/go-gormigrate/gormigrate/v2"
+	"gorm.io/gorm"
+)
+
+// BackendAdminMigrations creates Winter-shaped backend identity tables and
+// seeds the developer and publisher system roles. History is isolated under
+// the summercms.cabana plugin id.
+var BackendAdminMigrations = []*gormigrate.Migration{
+	{
+		ID: "202609240001_backend_admin_identity",
+		Migrate: func(tx *gorm.DB) error {
+			stmts := []string{
+				`CREATE TABLE backend_user_roles (
+	id SERIAL PRIMARY KEY,
+	name TEXT NOT NULL UNIQUE,
+	code TEXT UNIQUE,
+	description TEXT,
+	permissions TEXT,
+	is_system BOOLEAN NOT NULL DEFAULT FALSE,
+	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+)`,
+				`CREATE TABLE backend_users (
+	id SERIAL PRIMARY KEY,
+	first_name TEXT,
+	last_name TEXT,
+	login TEXT NOT NULL UNIQUE,
+	email TEXT NOT NULL UNIQUE,
+	password TEXT NOT NULL,
+	activation_code TEXT,
+	persist_code TEXT,
+	reset_password_code TEXT,
+	permissions TEXT,
+	is_activated BOOLEAN NOT NULL DEFAULT FALSE,
+	is_superuser BOOLEAN NOT NULL DEFAULT FALSE,
+	role_id INTEGER REFERENCES backend_user_roles(id),
+	activated_at TIMESTAMPTZ,
+	last_login TIMESTAMPTZ,
+	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	deleted_at TIMESTAMPTZ
+)`,
+				`CREATE INDEX backend_users_role_id_index ON backend_users (role_id)`,
+				`CREATE INDEX backend_users_deleted_at_index ON backend_users (deleted_at)`,
+				`INSERT INTO backend_user_roles (name, code, description, permissions, is_system)
+VALUES
+	('Developer', 'developer', 'Site administrator with access to developer tools.', '{}', TRUE),
+	('Publisher', 'publisher', 'Site editor with access to publishing tools.', '{}', TRUE)`,
+			}
+			for _, stmt := range stmts {
+				if err := tx.Exec(stmt).Error; err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+		Rollback: func(tx *gorm.DB) error {
+			if err := tx.Exec(`DROP TABLE IF EXISTS backend_users`).Error; err != nil {
+				return err
+			}
+			return tx.Exec(`DROP TABLE IF EXISTS backend_user_roles`).Error
+		},
+	},
+}

lagoon/migrations.go

@@ -57,8 +57,8 @@ func migrator(gdb *gorm.DB, pluginID string, migrations []*gormigrate.Migration)
 	}, migrations), nil
 }
 
-// Migrate runs the framework-owned system_files set first, then each
-// plugin's HasMigrations set in party.Activate order.
+// Migrate runs the framework-owned system_files and backend-admin sets
+// first, then each plugin's HasMigrations set in party.Activate order.
 func Migrate(gdb *gorm.DB, plugins []party.Plugin) error {
 	if gdb == nil {
 		return fmt.Errorf("lagoon: gorm db is nil")
@@ -70,6 +70,13 @@ func Migrate(gdb *gorm.DB, plugins []party.Plugin) error {
 	if err := m.Migrate(); err != nil {
 		return fmt.Errorf("lagoon: migrate system_files: %w", err)
 	}
+	admin, err := migrator(gdb, "summercms.cabana", BackendAdminMigrations)
+	if err != nil {
+		return err
+	}
+	if err := admin.Migrate(); err != nil {
+		return fmt.Errorf("lagoon: migrate backend admin: %w", err)
+	}
 	for _, p := range plugins {
 		hm, ok := p.(pact.HasMigrations)
 		if !ok {