Admin hub in /crush33: sidebar, donor lookup, danger-zone actions

Rebuilt the password-gated /crush33 (in-app /comp) screen into an admin
hub with a left sidebar and three sections:

- Comp tickets — the existing entry-only comp creator.
- Donor lookup — admin-only free-text search across the donor master
  list + online/offline transaction tables by name / email / phone /
  address / bear name (columns discovered per table, deduped by email).
- Actions (danger zone) — heavy warnings, red buttons, and an
  "are you sure" modal that spells out exactly what will happen:
    • Wipe slate — delete ALL ticket + audit records in the active
      event table (donor data untouched, irreversible).
    • Switch event table — repoint the app at a different NocoDB
      tickets/audit table to start a new event while keeping the old
      one intact.

Backend:
- New /api/admin/{status,wipe,switch-table,donor-search}, all gated by
  PORTAL_PASSWORD (POST-only so it never lands in a URL/log).
- NocoDBClient + AuditLogger: runtime-switchable tableId, count(),
  deleteAll(), probeTable() (reachable + Id-PK check before switching).
- DonorService.search() with adaptive column discovery.
- Table switch persists across redeploys via a small state file on a
  new /data volume (Dockerfile creates it owned by node so it's
  writable); applied at startup in buildContext.

Also shipped equivalent CLI scripts: scripts/wipe-slate.sh and
scripts/switch-event.sh. Drawer: "Comp tickets" -> "Admin (crush33)".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/lib/api.ts

@@ -252,6 +252,56 @@ export async function portalCreate(input: {
   return body;
 }
 
+// ---- Admin actions (all gated by the portal password) ----
+
+async function adminPost<T>(path: string, password: string, extra: Record<string, unknown> = {}): Promise<T> {
+  const res = await fetch(`${API_BASE}${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password, ...extra }),
+  });
+  if (res.status === 401) throw new AuthError("Wrong password");
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) throw new ApiError(body?.detail ?? body?.error ?? `Request failed (${res.status})`);
+  return body as T;
+}
+
+export interface AdminStatus {
+  tickets: { tableId: string; count: number };
+  audit: { tableId: string | null; count: number; enabled: boolean };
+  defaults: { ticketsTableId: string; auditTableId: string | null };
+}
+export function adminStatus(password: string): Promise<AdminStatus> {
+  return adminPost<AdminStatus>("/api/admin/status", password);
+}
+
+export function adminWipe(password: string): Promise<{ ok: boolean; ticketsDeleted: number; auditDeleted: number }> {
+  return adminPost("/api/admin/wipe", password);
+}
+
+export function adminSwitchTable(
+  password: string,
+  ticketsTableId: string,
+  auditTableId?: string,
+): Promise<{ ok: boolean; tickets: { tableId: string }; audit: { tableId: string | null } }> {
+  return adminPost("/api/admin/switch-table", password, { ticketsTableId, auditTableId });
+}
+
+export interface DonorSearchResult {
+  name: string;
+  bearName: string;
+  email: string;
+  altEmail: string;
+  phone: string;
+  address: string;
+  lifetime: number | null;
+  tags: string[];
+  source: "master" | "transactions";
+}
+export function adminDonorSearch(password: string, query: string): Promise<{ results: DonorSearchResult[]; query: string }> {
+  return adminPost("/api/admin/donor-search", password, { query });
+}
+
 export function getAudit(opts: { code?: string; limit?: number } = {}): Promise<{
   enabled: boolean;
   entries: AuditEntry[];