Joshua overseer
7a26845abe Admin routes: quest definitions
c70521915d Admin routes: children CRUD over the core business layer
42a205b4bd Admin auth: constant-time panel-token comparison in require_admin
4d697dc025 Admin routes: require_admin gates nestquest-admins group, refuses panel token
80ac786a54 Admin auth: harden JWKS cache against outage amplification (P2) and corrupt/unknown-key handling (P3)
3cdedb37c8 Admin plane: validate Authentik OIDC JWTs on /api/v1/admin/*
8078ca1661 SSE: publish uncompleted, child-day-complete and missed transitions
4e79aebc22 SSE endpoint publishing quest-completed transitions (task 4d7bae00)
76d1970625 Panel plane: complete route (idempotent)
db07670f44 Serve the panel snapshot behind a reusable service-token dependency (task ae7e90ae)
f2e354ac39 Make the reusable prompt terminal-only
2e763cfa77 Run orchestration directly in foreground OpenCode