fix: unify staging admin access

deploy/.env.staging.identity.example

@@ -3,19 +3,16 @@
 APP_ENV_FILE=../.env.staging
 CADDYFILE_PATH=./Caddyfile.staging
 SITE_ADDRESS=https://staging.jyotisha.chat
-ADMIN_SITE_ADDRESS=https://admin.staging.jyotisha.chat
 
 # Staging-only cutover: identity and business data both use the private local
 # PostgreSQL service. Production remains on Supabase until a separate cutover.
 AUTH_PROVIDER=self-hosted
 SELF_HOSTED_IDENTITY_ENABLED=true
 AUTH_USER_ORIGIN=https://staging.jyotisha.chat
-AUTH_ADMIN_ORIGIN=https://admin.staging.jyotisha.chat
 IDENTITY_DATABASE_URL=postgresql://identity_runtime:<percent-encoded-identity-runtime-password>@postgres:5432/jyotisha
 APP_DATABASE_URL=postgresql://app_runtime:<percent-encoded-app-runtime-password>@postgres:5432/jyotisha
 ADMIN_DATABASE_URL=postgresql://admin_runtime:<percent-encoded-admin-runtime-password>@postgres:5432/jyotisha
 BETTER_AUTH_USER_SECRET=<independent-openssl-rand-base64-32-output>
-BETTER_AUTH_ADMIN_SECRET=<different-openssl-rand-base64-32-output>
 RESEND_API_KEY=<staging-only-resend-api-key>
 RESEND_FROM_EMAIL=Jyotisha Staging <login@staging.jyotisha.chat>
 ADMIN_EMAILS=<comma-separated-staging-admin-emails>

deploy/Caddyfile.staging

@@ -1,21 +1,4 @@
 {$SITE_ADDRESS:https://staging.jyotisha.chat} {
     encode zstd gzip
-
-    @adminPaths path /admin /admin/* /api/admin/*
-    respond @adminPaths "Not found" 404
-
     reverse_proxy web:3000
 }
-
-{$ADMIN_SITE_ADDRESS:https://admin.staging.jyotisha.chat} {
-    encode zstd gzip
-
-    @adminRoot path /
-    redir @adminRoot /admin/codes 302
-
-    @adminSurface path /login /admin /admin/* /api/admin/* /api/auth/* /_next/* /jyotish-logo.png /favicon.ico
-    handle @adminSurface {
-        reverse_proxy web:3000
-    }
-    respond "Not found" 404
-}

deploy/README.md

@@ -176,10 +176,9 @@ The staging env file must include these non-secret selectors so Compose cannot f
 APP_ENV_FILE=../.env.staging
 CADDYFILE_PATH=./Caddyfile.staging
 SITE_ADDRESS=https://staging.jyotisha.chat
-ADMIN_SITE_ADDRESS=https://admin.staging.jyotisha.chat
 ```
 
-Staging is fully self-hosted: set `AUTH_PROVIDER=self-hosted` and `SELF_HOSTED_IDENTITY_ENABLED=true`. Add the three role-specific server-only database URLs, separate user/admin Better Auth secrets, origins, and staging-only Resend settings listed in `deploy/.env.staging.identity.example`. Browser code uses same-origin APIs; it receives neither database credentials nor Supabase keys. Production remains on Supabase and is not changed by the staging workflow. See `docs/operations/self-hosted-identity.md` for validation and rollback commands.
+Staging is fully self-hosted: set `AUTH_PROVIDER=self-hosted` and `SELF_HOSTED_IDENTITY_ENABLED=true`. Add the three role-specific server-only database URLs, the single `AUTH_USER_ORIGIN` and `BETTER_AUTH_USER_SECRET`, and staging-only Resend settings listed in `deploy/.env.staging.identity.example`. The main-site Better Auth user session is also used by `/admin`; persisted `identity.users.role=admin` is the only self-hosted backend role, while `viewer` and ordinary users are denied. Browser code uses same-origin APIs; it receives neither database credentials nor Supabase keys. Production remains on Supabase and is not changed by the staging workflow. See `docs/operations/self-hosted-identity.md` for validation and rollback commands.
 
 After source sync and before `up`, the workflow validates `.env.staging` mode/selectors, explicitly pins the three staging selectors against ambient shell overrides, and runs `docker compose --env-file .env.staging -f deploy/docker-compose.server.yml config --quiet`. For later manual inspections, run the same checks only after the tracked deployment files exist on the server. Do not use a manual gate run from `main` as the first publishing path: publishing requires a successful push to `staging`, while manual `Deploy staging` requires a successful gate run for the exact SHA.
 

deploy/configure-staging-rectification-rollout.sh

@@ -140,7 +140,6 @@ export APP_ENV_FILE='../.env.staging'
 export DATABASE_ENV_FILE='../.env.staging.database'
 export CADDYFILE_PATH='./Caddyfile.staging'
 export SITE_ADDRESS='https://staging.jyotisha.chat'
-export ADMIN_SITE_ADDRESS='https://admin.staging.jyotisha.chat'
 export GITHUB_SHA="$EXPECTED_DEPLOY_SHA"
 compose=(docker compose -p jyotisha-staging --env-file .env.staging "${compose_files[@]}")
 

deploy/docker-compose.server.yml

@@ -53,7 +53,6 @@ services:
     restart: unless-stopped
     environment:
       SITE_ADDRESS: ${SITE_ADDRESS:-https://jyotisha.chat}
-      ADMIN_SITE_ADDRESS: ${ADMIN_SITE_ADDRESS:-https://admin.staging.jyotisha.chat}
     ports:
       - "80:80"
       - "443:443"

deploy/run-staging-deploy.sh

@@ -128,7 +128,6 @@ export APP_ENV_FILE='../.env.staging'
 export DATABASE_ENV_FILE='../.env.staging.database'
 export CADDYFILE_PATH='./Caddyfile.staging'
 export SITE_ADDRESS='https://staging.jyotisha.chat'
-export ADMIN_SITE_ADDRESS='https://admin.staging.jyotisha.chat'
 export GITHUB_SHA="$DEPLOY_SHA"
 
 "${compose[@]}" config --quiet
@@ -186,7 +185,6 @@ verify_container_image rectification-v4-worker "$WEB_IMAGE"
 
 "${compose[@]}" exec -T \
   -e EXPECTED_SHA="$DEPLOY_SHA" -e STAGING_URL="$STAGING_URL" \
-  -e STAGING_ADMIN_URL="https://admin.staging.jyotisha.chat" \
   web node --input-type=module <<'NODE'
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 let login;
@@ -198,15 +196,10 @@ for (let attempt = 0; attempt < 12; attempt += 1) {
   await delay(5_000);
 }
 if (!login?.ok) process.exit(1);
-const adminLogin = await fetch(`${process.env.STAGING_ADMIN_URL}/login`);
-if (!adminLogin.ok) process.exit(1);
-const adminRoot = await fetch(process.env.STAGING_ADMIN_URL, { redirect: "manual" });
-if (
-  adminRoot.status !== 302 ||
-  adminRoot.headers.get("location") !== "/admin/codes"
-) process.exit(1);
-const adminSession = await fetch(`${process.env.STAGING_ADMIN_URL}/api/auth/get-session`);
-if (!adminSession.ok) process.exit(1);
+const adminPage = await fetch(`${process.env.STAGING_URL}/admin`, { redirect: "manual" });
+if (adminPage.status !== 307 || adminPage.headers.get("location") !== "/login") process.exit(1);
+const adminApi = await fetch(`${process.env.STAGING_URL}/api/admin/session`);
+if (adminApi.status !== 401) process.exit(1);
 const account = await fetch(`${process.env.STAGING_URL}/api/account`);
 if (account.status !== 401) process.exit(1);
 const publicHealth = await fetch(`${process.env.STAGING_URL}/api/health`);

deploy/validate-staging-env.sh

@@ -41,11 +41,9 @@ require_selector() {
 require_selector APP_ENV_FILE ../.env.staging
 require_selector CADDYFILE_PATH ./Caddyfile.staging
 require_selector SITE_ADDRESS https://staging.jyotisha.chat
-require_selector ADMIN_SITE_ADDRESS https://admin.staging.jyotisha.chat
 require_selector AUTH_PROVIDER self-hosted
 require_selector SELF_HOSTED_IDENTITY_ENABLED true
 require_selector AUTH_USER_ORIGIN https://staging.jyotisha.chat
-require_selector AUTH_ADMIN_ORIGIN https://admin.staging.jyotisha.chat
 
 require_literal() {
   local key="$1"
@@ -88,13 +86,6 @@ if ! [[ "$admin_database_url" =~ ^postgresql://admin_runtime:([A-Za-z0-9._~-]|%[
 fi
 
 require_literal BETTER_AUTH_USER_SECRET 32
-user_secret="$LITERAL_VALUE"
-require_literal BETTER_AUTH_ADMIN_SECRET 32
-admin_secret="$LITERAL_VALUE"
-if [ "$user_secret" = "$admin_secret" ]; then
-  echo "staging identity secrets must be different" >&2
-  exit 1
-fi
 require_literal RESEND_API_KEY 10
 require_literal RESEND_FROM_EMAIL 5
 if [[ "$LITERAL_VALUE" != *@* ]]; then