Admin dashboard

The operator dashboard is served by the API at <PUBLIC_URL>/admin and is off unless ADMIN_SECRET_KEY is set.

1. Generate a key: openssl rand -base64 32, and set it as ADMIN_SECRET_KEY.
2. In the API container, create your operator account:

   pnpm --filter @fellesly/api admin create you@example.com

   Add the printed TOTP secret to an authenticator app and keep the recovery codes offline.
3. Restart the API and sign in at /admin with password and code.

From the dashboard you can grant tiers with custom limits, suspend accounts (which also revokes their sessions and access tokens), export and erase accounts on request, and read the append-only audit log. Calendars, lists, messages and files are never shown to operators.

Other commands: admin list, admin reset-mfa <email>, admin remove <email>.