2 Commits

Author	SHA1	Message	Date
Jakub Zych	8c1de83f01	test(09-01): add failing audience crossover and authorization-order tests ... - Same-secret backend token is still accepted by the frontend guard - Permission denial must not invoke the schema or database callback - Admin error bodies must not echo secrets or raw tokens	2026-09-24 17:19:57 +02:00
Jakub Zych	dfa00f7e3a	feat(09-01): implement separate-admin genre list tracer ... - Audience-aware mint, verify, refresh, and backend guard keep frontend tokens compatible - Cabana mounts raw admin login, list schema, and record list behind admin.jwt.secret - Framework migration seeds Winter backend users and developer/publisher roles	2026-09-24 17:17:19 +02:00