Admin: tool registry, grouped nav, and an /admin/ hub

.claude-context/01-architecture.md

@@ -111,6 +111,29 @@ across the table. A layout re-saved by an editor that does not understand wall
 anchors can silently become flat. Reference values: A3 rig with the tower ~3.5cm,
 a town layout with one wall crest at 8cm ~2.7cm, any all-tabletop layout 0.0cm.
 
+## Admin chrome
+
+`public/admin/admin.js` holds a `TOOLS` registry — id, display name, group and
+a one-line blurb for every admin page. The nav bar (`nav()`) and the hub
+(`/admin/index.html`) are both generated from it, so a new page is registered
+once and cannot appear in one and not the other. `tools/check-admin-nav.mjs`
+checks the other direction: every `.html` in `public/admin` except the hub and
+the login screen must be registered.
+
+This replaced a hand-kept array of filenames, under which `testsheet.html`
+existed but was listed nowhere, and `calibrate.html` was listed but never
+rendered the bar — and never called `requireAuth()`, so in final mode it was
+the one admin page reachable without the password.
+
+Two pages cannot host the bar: `calibrate.html` is a full-bleed camera view and
+`testsheet.html` must print edge to edge. They carry `chrome: false` and get a
+link home instead — a floating pill (`backLink()`, styled by the separately
+exported `BACK_CSS`) for calibrate, an inline link in the existing toolbar for
+testsheet, where a floating pill would cover the Print button.
+
+`nav()`'s root element stays `<header>`: `print.html` hides `header` on print
+and `plan.html` hides its `#hdr` wrapper, and both rules depend on it.
+
 ## Camera model
 
 Everything derives from one assumption — `HFOV_DEG` (default 60, override via