add platform pages

frontend/src/lib/server/session.ts

@@ -29,4 +29,25 @@ const LEGACY_DEVICE_COOKIE = 'device_token';
 
 export function clearLegacyCookies(cookies: Cookies) {
 	cookies.delete(LEGACY_DEVICE_COOKIE, { path: '/' });
+}
+
+// ── Platform-admin session (/admin) ──
+// Holds a REAL PocketBase superuser JWT (minted by _superusers.authWithPassword
+// at login) — verified per-request in hooks via authRefresh, so forging the
+// cookie value gains nothing. Separate from the fam-user pb_token.
+export const PLATFORM_SESSION_COOKIE = 'platform_session';
+const PLATFORM_MAX_AGE = 60 * 60 * 24; // 24h; PB token expiry is the ceiling
+
+export function setPlatformSession(cookies: Cookies, token: string) {
+	cookies.set(PLATFORM_SESSION_COOKIE, token, {
+		httpOnly: true,
+		sameSite: 'lax',
+		path: '/',
+		maxAge: PLATFORM_MAX_AGE,
+		secure: import.meta.env.PROD
+	});
+}
+
+export function clearPlatformSession(cookies: Cookies) {
+	cookies.delete(PLATFORM_SESSION_COOKIE, { path: '/' });
 }