feat(sprint18): editor autosave/reset, admin auth, QR reuse, Ed25519 prep

- Project editor: persist draft to localStorage, restore on reload,
  last-saved/draft-restored status indicators, section/whole-draft reset
  with confirmation.
- Extract shared QR/polling/expiry engine from TelegramLoginComponent
  (shared/qr-login) and reuse it for a new admin login flow.
- Admin authentication kept fully separate from customer session:
  own cookie/localStorage keys, signals, guard, and header interceptor
  (core/admin-auth).
- ?login=true / ?adminLogin=true open the respective login dialog for
  manual testing.
- Ed25519 challenge/verify interfaces (fail-closed no-op binding) ready
  for backend delivery.
- Document autosave/reset/admin-auth/QR-reuse/Ed25519 model and the
  remaining full-field-coverage gap in docs/Project-Editor.md.

src/app/core/admin-auth/admin-auth-headers.interceptor.ts

@@ -0,0 +1,29 @@
+import { HttpInterceptorFn } from '@angular/common/http';
+import { inject } from '@angular/core';
+import { AdminAuthService } from './admin-auth.service';
+
+/**
+ * Attaches admin session/token headers only to admin API requests. Mirrors
+ * apiHeadersInterceptor's self-guarding pattern but scoped to `/admin` so it
+ * never touches customer requests and never reads AuthService's session.
+ */
+export const adminAuthHeadersInterceptor: HttpInterceptorFn = (req, next) => {
+  const isAdminRequest = req.url.includes('/admin/');
+  if (!isAdminRequest) {
+    return next(req);
+  }
+
+  const adminAuth = inject(AdminAuthService);
+  const session = adminAuth.session();
+  const token = adminAuth.getAdminToken();
+
+  let headers = req.headers;
+  if (session?.sessionId) {
+    headers = headers.set('AdminWebSessionID', session.sessionId);
+  }
+  if (token) {
+    headers = headers.set('Authorization', `Bearer ${token}`);
+  }
+
+  return next(req.clone({ headers }));
+};

src/app/core/admin-auth/admin-auth.guard.ts

@@ -0,0 +1,15 @@
+import { inject } from '@angular/core';
+import { CanActivateFn } from '@angular/router';
+import { AdminAuthService } from './admin-auth.service';
+
+/** Guards `/admin/**` routes. Never shares state with the customer auth guard/service. */
+export const adminAuthGuard: CanActivateFn = () => {
+  const adminAuth = inject(AdminAuthService);
+
+  if (adminAuth.isAuthenticated()) {
+    return true;
+  }
+
+  adminAuth.requestLogin();
+  return false;
+};

src/app/core/admin-auth/admin-auth.service.ts

@@ -0,0 +1,286 @@
+import { Injectable, signal, computed } from '@angular/core';
+import { HttpClient } from '@angular/common/http';
+import { Observable, of, catchError, map, tap } from 'rxjs';
+import { AdminAuthStatus, AdminSession, AdminWebSessionStart } from '../../models/admin-auth.model';
+import { environment } from '../../../environments/environment';
+import { generateGuid } from '../../shared/util/guid.util';
+
+/**
+ * Admin session storage is completely separate from customer session storage
+ * (AuthService uses cookie `webSessionID` + localStorage `web_session_id`).
+ * Distinct cookie/localStorage names here are intentional: an admin login must
+ * never authenticate the customer session and vice versa.
+ */
+const ADMIN_SESSION_COOKIE = 'adminSessionID';
+const ADMIN_TOKEN_STORAGE_KEY = 'adminToken';
+const ADMIN_REFRESH_STORAGE_KEY = 'adminRefreshToken';
+const ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS = 60 * 60;
+
+@Injectable({ providedIn: 'root' })
+export class AdminAuthService {
+  private readonly sessionSignal = signal<AdminSession | null>(null);
+  private readonly statusSignal = signal<AdminAuthStatus>('unknown');
+  private readonly showLoginSignal = signal(false);
+
+  readonly session = this.sessionSignal.asReadonly();
+  readonly status = this.statusSignal.asReadonly();
+  readonly isAuthenticated = computed(() => this.statusSignal() === 'authenticated');
+  readonly showLoginDialog = this.showLoginSignal.asReadonly();
+  readonly displayName = computed(() => this.sessionSignal()?.displayName ?? null);
+  readonly role = computed(() => this.sessionSignal()?.role ?? null);
+
+  private readonly adminAuthApiUrl = (environment as Record<string, unknown>)['adminAuthApiUrl'] as string
+    ?? `${environment.authApiUrl}/admin`;
+  private sessionCheckTimer?: ReturnType<typeof setTimeout>;
+
+  constructor(private readonly http: HttpClient) {
+    this.checkSession();
+  }
+
+  checkSession(): void {
+    const webSessionID = this.getStoredAdminSessionID();
+    if (!webSessionID) {
+      this.clearAuthState('unauthenticated');
+      return;
+    }
+
+    this.statusSignal.set('checking');
+    this.checkSessionOnce(webSessionID).subscribe(session => {
+      if (!session?.active) {
+        this.clearAuthState('unauthenticated');
+      }
+    });
+  }
+
+  /** Check session without mutating internal state (used for polling). */
+  checkSessionOnce(webSessionID = this.getStoredAdminSessionID()): Observable<AdminSession | null> {
+    if (!webSessionID) {
+      return of(null);
+    }
+
+    return this.http.get<Record<string, unknown>>(
+      `${this.adminAuthApiUrl}/sessions/${encodeURIComponent(webSessionID)}`
+    ).pipe(
+      map(response => this.normalizeSession(response, webSessionID)),
+      tap(session => {
+        if (session?.active) {
+          this.activateSession(session);
+        }
+      }),
+      catchError(() => of(null))
+    );
+  }
+
+  /** Create a backend admin web session, to be scanned/opened the same way customer QR login works. */
+  createWebSession(): Observable<AdminWebSessionStart> {
+    const webSessionID = generateGuid();
+
+    return this.http.post<Record<string, unknown>>(
+      `${this.adminAuthApiUrl}/sessions`,
+      { webSessionID },
+      { headers: { AdminWebSessionID: webSessionID } }
+    ).pipe(
+      map(response => {
+        const responseWebSessionID = this.extractSessionId(response, webSessionID);
+        return {
+          webSessionID: responseWebSessionID,
+          url: this.getAdminLoginUrl(responseWebSessionID),
+        };
+      })
+    );
+  }
+
+  getAdminLoginUrl(webSessionID: string): string {
+    const botUsername = this.getAdminBotUsername();
+    return `https://t.me/${botUsername}?start=admin_${encodeURIComponent(webSessionID)}`;
+  }
+
+  getAdminAppLoginUrl(webSessionID: string): string {
+    const botUsername = this.getAdminBotUsername();
+    return `tg://resolve?domain=${encodeURIComponent(botUsername)}&start=admin_${encodeURIComponent(webSessionID)}`;
+  }
+
+  onLoginComplete(): void {
+    this.hideLogin();
+    if (!this.isAuthenticated()) {
+      this.checkSession();
+    }
+  }
+
+  requestLogin(): void {
+    this.showLoginSignal.set(true);
+  }
+
+  hideLogin(): void {
+    this.showLoginSignal.set(false);
+  }
+
+  logout(): void {
+    const webSessionID = this.sessionSignal()?.sessionId || this.getStoredAdminSessionID();
+    if (!webSessionID) {
+      this.clearAuthState('unauthenticated');
+      return;
+    }
+
+    this.http.delete(`${this.adminAuthApiUrl}/sessions/${encodeURIComponent(webSessionID)}`, {
+      headers: { AdminWebSessionID: webSessionID }
+    }).pipe(catchError(() => of(null))).subscribe(() => this.clearAuthState('unauthenticated'));
+  }
+
+  /** JWT pair storage, reserved for once the backend issues admin access/refresh tokens. Unused until then. */
+  getAdminToken(): string | null {
+    return typeof localStorage === 'undefined' ? null : localStorage.getItem(ADMIN_TOKEN_STORAGE_KEY);
+  }
+
+  setAdminTokens(token: string, refreshToken: string): void {
+    if (typeof localStorage === 'undefined') {
+      return;
+    }
+    localStorage.setItem(ADMIN_TOKEN_STORAGE_KEY, token);
+    localStorage.setItem(ADMIN_REFRESH_STORAGE_KEY, refreshToken);
+  }
+
+  clearAdminTokens(): void {
+    if (typeof localStorage === 'undefined') {
+      return;
+    }
+    localStorage.removeItem(ADMIN_TOKEN_STORAGE_KEY);
+    localStorage.removeItem(ADMIN_REFRESH_STORAGE_KEY);
+  }
+
+  private activateSession(session: AdminSession): void {
+    this.sessionSignal.set(session);
+    this.statusSignal.set('authenticated');
+    this.setStoredAdminSessionID(session.sessionId);
+    this.scheduleSessionRefresh(session.expires);
+  }
+
+  private clearAuthState(status: AdminAuthStatus): void {
+    this.sessionSignal.set(null);
+    this.statusSignal.set(status);
+    this.clearStoredAdminSessionID();
+    this.clearAdminTokens();
+    this.clearSessionRefresh();
+  }
+
+  private scheduleSessionRefresh(expiresAt: string): void {
+    this.clearSessionRefresh();
+    const expiresMs = new Date(expiresAt).getTime();
+    const nowMs = Date.now();
+    const refreshIn = Number.isFinite(expiresMs)
+      ? Math.max(expiresMs - nowMs - 60_000, 30_000)
+      : ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS * 1000;
+
+    this.sessionCheckTimer = setTimeout(() => this.checkSession(), refreshIn);
+  }
+
+  private clearSessionRefresh(): void {
+    if (this.sessionCheckTimer) {
+      clearTimeout(this.sessionCheckTimer);
+      this.sessionCheckTimer = undefined;
+    }
+  }
+
+  private normalizeSession(response: Record<string, unknown> | null, fallbackSessionId: string): AdminSession | null {
+    if (!response) {
+      return null;
+    }
+
+    const status = this.readFirst(response, ['status', 'Status', 'active', 'Active', 'authenticated', 'Authenticated']);
+    const active = this.isActiveStatus(status);
+    const sessionId = this.extractSessionId(response, fallbackSessionId);
+    const username = this.readString(this.readFirst(response, ['username', 'Username']));
+    const displayName = this.readString(this.readFirst(response, ['displayName', 'DisplayName', 'name', 'Name'])) ?? username ?? 'Admin';
+    const role = this.readString(this.readFirst(response, ['role', 'Role']));
+    const adminId = this.readNumber(this.readFirst(response, ['adminId', 'AdminId', 'userId', 'UserId', 'id', 'ID']));
+    const expiresAt = this.readString(this.readFirst(response, ['expiresAt', 'ExpiresAt', 'expires', 'Expires']))
+      ?? new Date(Date.now() + ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS * 1000).toISOString();
+
+    return { sessionId, adminId, username, displayName, role, active, expires: expiresAt };
+  }
+
+  private extractSessionId(response: Record<string, unknown> | null, fallbackSessionId: string): string {
+    if (!response) {
+      return fallbackSessionId;
+    }
+    return this.readString(this.readFirst(response, [
+      'webSessionID', 'WebSessionID', 'sessionID', 'SessionID', 'sessionId', 'id', 'ID'
+    ])) ?? fallbackSessionId;
+  }
+
+  private readFirst(source: Record<string, unknown>, keys: string[]): unknown {
+    for (const key of keys) {
+      if (Object.prototype.hasOwnProperty.call(source, key)) {
+        return source[key];
+      }
+    }
+    return undefined;
+  }
+
+  private readString(value: unknown): string | null {
+    if (typeof value === 'string' && value.trim()) {
+      return value;
+    }
+    if (typeof value === 'number' || typeof value === 'bigint') {
+      return value.toString();
+    }
+    return null;
+  }
+
+  private readNumber(value: unknown): number | null {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      return value;
+    }
+    if (typeof value === 'string') {
+      const parsed = Number(value);
+      return Number.isFinite(parsed) ? parsed : null;
+    }
+    return null;
+  }
+
+  private isActiveStatus(status: unknown): boolean {
+    if (status === true || status === 1) {
+      return true;
+    }
+    if (typeof status !== 'string') {
+      return false;
+    }
+    return ['true', '1', 'active', 'authenticated', 'confirmed', 'success', 'logged_in'].includes(status.toLowerCase());
+  }
+
+  private getStoredAdminSessionID(): string | null {
+    if (typeof document === 'undefined') {
+      return null;
+    }
+    const cookie = document.cookie.split('; ').find(row => row.startsWith(`${ADMIN_SESSION_COOKIE}=`));
+    if (!cookie) {
+      return null;
+    }
+    try {
+      return decodeURIComponent(cookie.substring(ADMIN_SESSION_COOKIE.length + 1));
+    } catch {
+      return null;
+    }
+  }
+
+  private setStoredAdminSessionID(webSessionID: string): void {
+    if (typeof document === 'undefined') {
+      return;
+    }
+    const secure = typeof window !== 'undefined' && window.location.protocol === 'https:' ? '; Secure' : '';
+    document.cookie = `${ADMIN_SESSION_COOKIE}=${encodeURIComponent(webSessionID)}; Max-Age=${ADMIN_SESSION_COOKIE_MAX_AGE_SECONDS}; Path=/; SameSite=Strict${secure}`;
+  }
+
+  private clearStoredAdminSessionID(): void {
+    if (typeof document === 'undefined') {
+      return;
+    }
+    document.cookie = `${ADMIN_SESSION_COOKIE}=; Max-Age=0; Path=/; SameSite=Strict`;
+  }
+
+  private getAdminBotUsername(): string {
+    return (environment as Record<string, unknown>)['adminTelegramBot'] as string
+      ?? (environment as Record<string, unknown>)['telegramBot'] as string
+      ?? 'DexarSupport_bot';
+  }
+}

src/app/core/admin-auth/admin-login.component.html

@@ -0,0 +1,72 @@
+@if (showDialog()) {
+  <div class="login-overlay" (click)="close()">
+    <div class="login-dialog" (click)="$event.stopPropagation()">
+      <button class="close-btn" (click)="close()">
+        <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path d="M18 6L6 18M6 6l12 12"/>
+        </svg>
+      </button>
+
+      <div class="login-icon">
+        <svg width="48" height="48" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+          <path d="M12 2 3 6v6c0 5 4 8.7 9 10 5-1.3 9-5 9-10V6l-9-4z"/>
+        </svg>
+      </div>
+
+      <h2>{{ 'adminAuth.loginRequired' | translate }}</h2>
+      <p class="login-desc">{{ 'adminAuth.loginDescription' | translate }}</p>
+
+      @if (status() === 'checking') {
+        <div class="login-status checking">
+          <div class="spinner"></div>
+          <span>{{ 'adminAuth.checking' | translate }}</span>
+        </div>
+      } @else {
+        <button class="telegram-btn" (click)="openAppLogin()">
+          {{ 'adminAuth.loginWithApp' | translate }}
+        </button>
+
+        <div class="qr-section">
+          <p class="qr-hint">{{ 'adminAuth.orScanQr' | translate }}</p>
+
+          @switch (qrStatus()) {
+            @case ('loading') {
+              <div class="qr-container qr-loading">
+                <div class="spinner"></div>
+              </div>
+            }
+            @case ('ready') {
+              <div class="qr-container">
+                <img [src]="'https://api.qrserver.com/v1/create-qr-code/?size=180x180&data=' + encodedQrUrl()"
+                     alt="QR Code"
+                     width="180"
+                     height="180"
+                     loading="eager" />
+              </div>
+            }
+            @case ('expired') {
+              <div class="qr-container qr-expired" (click)="refreshQr()">
+                <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                  <path d="M1 4v6h6M23 20v-6h-6"/>
+                  <path d="M20.49 9A9 9 0 0 0 5.64 5.64L1 10m22 4l-4.64 4.36A9 9 0 0 1 3.51 15"/>
+                </svg>
+                <span>{{ 'adminAuth.qrExpired' | translate }}</span>
+              </div>
+            }
+            @case ('error') {
+              <div class="qr-container qr-error" (click)="refreshQr()">
+                <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                  <path d="M1 4v6h6M23 20v-6h-6"/>
+                  <path d="M20.49 9A9 9 0 0 0 5.64 5.64L1 10m22 4l-4.64 4.36A9 9 0 0 1 3.51 15"/>
+                </svg>
+                <span>{{ 'adminAuth.qrError' | translate }}</span>
+              </div>
+            }
+          }
+        </div>
+
+        <p class="login-note">{{ 'adminAuth.loginNote' | translate }}</p>
+      }
+    </div>
+  </div>
+}

src/app/core/admin-auth/admin-login.component.scss

@@ -0,0 +1,254 @@
+.login-overlay {
+  position: fixed;
+  inset: 0;
+  background: rgba(0, 0, 0, 0.5);
+  backdrop-filter: blur(4px);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 10000;
+  animation: fadeIn 0.2s ease;
+  padding: 16px;
+}
+
+.login-dialog {
+  position: relative;
+  background: var(--bg-card, #fff);
+  border-radius: 20px;
+  padding: 32px 28px;
+  max-width: 400px;
+  width: 100%;
+  text-align: center;
+  box-shadow: 0 20px 60px rgba(0, 0, 0, 0.2);
+  animation: scaleIn 0.25s ease;
+}
+
+.close-btn {
+  position: absolute;
+  top: 12px;
+  right: 12px;
+  width: 32px;
+  height: 32px;
+  border: none;
+  border-radius: 50%;
+  background: var(--bg-hover, #f0f0f0);
+  color: var(--text-secondary, #666);
+  cursor: pointer;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  transition: all 0.2s ease;
+
+  &:hover {
+    background: #e0e0e0;
+    color: #333;
+  }
+}
+
+.login-icon {
+  margin: 0 auto 16px;
+  width: 72px;
+  height: 72px;
+  border-radius: 50%;
+  background: var(--accent-light, rgba(73, 118, 113, 0.1));
+  color: var(--accent-color, #497671);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+h2 {
+  margin: 0 0 8px;
+  font-size: 20px;
+  font-weight: 700;
+  color: var(--text-primary, #1a1a1a);
+}
+
+.login-desc {
+  margin: 0 0 24px;
+  font-size: 14px;
+  color: var(--text-secondary, #666);
+  line-height: 1.5;
+}
+
+.telegram-btn {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  width: 100%;
+  padding: 14px 24px;
+  border: none;
+  border-radius: 12px;
+  background: #2AABEE;
+  color: #fff;
+  font-size: 16px;
+  font-weight: 600;
+  cursor: pointer;
+  transition: all 0.2s ease;
+
+  &:hover {
+    background: #229ED9;
+    transform: translateY(-1px);
+    box-shadow: 0 4px 12px rgba(42, 171, 238, 0.3);
+  }
+
+  &:active {
+    transform: translateY(0);
+  }
+
+  .tg-icon {
+    flex-shrink: 0;
+  }
+}
+
+.bot-link {
+  display: block;
+  margin-top: 10px;
+  color: var(--accent-color, #497671);
+  font-size: 12px;
+  line-height: 1.35;
+  overflow-wrap: anywhere;
+  text-decoration: none;
+
+  &:hover {
+    text-decoration: underline;
+  }
+}
+
+.qr-section {
+  margin-top: 20px;
+
+  .qr-hint {
+    margin: 0 0 12px;
+    font-size: 13px;
+    color: var(--text-secondary, #999);
+  }
+
+  .qr-container {
+    display: inline-flex;
+    padding: 12px;
+    background: #fff;
+    border-radius: 12px;
+    border: 1px solid #e8e8e8;
+
+    img {
+      display: block;
+      border-radius: 4px;
+    }
+
+    &.qr-loading {
+      align-items: center;
+      justify-content: center;
+      width: 204px;
+      height: 204px;
+
+      .spinner {
+        width: 32px;
+        height: 32px;
+        border: 3px solid #e0e0e0;
+        border-top-color: var(--accent-color, #497671);
+        border-radius: 50%;
+        animation: spin 0.8s linear infinite;
+      }
+    }
+
+    &.qr-expired {
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      gap: 8px;
+      width: 204px;
+      height: 204px;
+      cursor: pointer;
+      color: var(--text-secondary, #999);
+      transition: color 0.2s ease;
+
+      &:hover {
+        color: var(--accent-color, #497671);
+      }
+
+      span {
+        font-size: 13px;
+      }
+    }
+
+    &.qr-error {
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+      gap: 8px;
+      width: 204px;
+      height: 204px;
+      cursor: pointer;
+      color: var(--text-secondary, #999);
+      transition: color 0.2s ease;
+
+      &:hover {
+        color: var(--accent-color, #497671);
+      }
+
+      span {
+        font-size: 13px;
+      }
+    }
+  }
+}
+
+.login-note {
+  margin: 16px 0 0;
+  font-size: 12px;
+  color: var(--text-secondary, #999);
+  line-height: 1.4;
+}
+
+.login-status {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 10px;
+  padding: 16px;
+  color: var(--text-secondary, #666);
+  font-size: 14px;
+
+  .spinner {
+    width: 20px;
+    height: 20px;
+    border: 2px solid #e0e0e0;
+    border-top-color: var(--accent-color, #497671);
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+  }
+}
+
+@keyframes fadeIn {
+  from { opacity: 0; }
+  to { opacity: 1; }
+}
+
+@keyframes scaleIn {
+  from {
+    opacity: 0;
+    transform: scale(0.95);
+  }
+  to {
+    opacity: 1;
+    transform: scale(1);
+  }
+}
+
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+
+@media (max-width: 480px) {
+  .login-dialog {
+    padding: 24px 20px;
+    border-radius: 16px;
+  }
+
+  .qr-section .qr-container img {
+    width: 140px;
+    height: 140px;
+  }
+}

src/app/core/admin-auth/admin-login.component.ts

@@ -0,0 +1,54 @@
+import { Component, ChangeDetectionStrategy, inject, effect, OnDestroy } from '@angular/core';
+import { AdminAuthService } from './admin-auth.service';
+import { TranslatePipe } from '../../i18n/translate.pipe';
+import { QrLoginEngine } from '../../shared/qr-login/qr-login.engine';
+import { QrLoginAdapter } from '../../shared/qr-login/qr-login.model';
+import { AdminSession } from '../../models/admin-auth.model';
+
+@Component({
+  selector: 'app-admin-login',
+  standalone: true,
+  imports: [TranslatePipe],
+  templateUrl: './admin-login.component.html',
+  styleUrls: ['./admin-login.component.scss'],
+  changeDetection: ChangeDetectionStrategy.OnPush
+})
+export class AdminLoginComponent implements OnDestroy {
+  private readonly adminAuth = inject(AdminAuthService);
+
+  readonly showDialog = this.adminAuth.showLoginDialog;
+  readonly status = this.adminAuth.status;
+
+  private readonly adapter: QrLoginAdapter<AdminSession> = {
+    createSession: () => this.adminAuth.createWebSession(),
+    checkSessionOnce: webSessionID => this.adminAuth.checkSessionOnce(webSessionID),
+    isSessionActive: session => !!session?.active,
+    getAppLoginUrl: webSessionID => this.adminAuth.getAdminAppLoginUrl(webSessionID),
+    onLoginComplete: () => this.adminAuth.onLoginComplete(),
+  };
+
+  private readonly engine = new QrLoginEngine<AdminSession>(this.adapter);
+  readonly qrStatus = this.engine.qrStatus;
+  readonly encodedQrUrl = this.engine.encodedQrUrl;
+
+  constructor() {
+    effect(() => this.engine.setActive(this.showDialog()));
+  }
+
+  ngOnDestroy(): void {
+    this.engine.destroy();
+  }
+
+  close(): void {
+    this.engine.setActive(false);
+    this.adminAuth.hideLogin();
+  }
+
+  openAppLogin(): void {
+    this.engine.openAppLogin();
+  }
+
+  refreshQr(): void {
+    this.engine.refresh();
+  }
+}

src/app/core/admin-auth/ed25519-verification.model.ts

@@ -0,0 +1,31 @@
+import { Observable } from 'rxjs';
+
+/**
+ * Prep interfaces for a future Ed25519 challenge/response admin auth flow.
+ * No crypto is implemented here - verification is delegated to an injectable
+ * service so the real implementation (native WebCrypto Ed25519 support, or a
+ * backend verification call) can be swapped in once the backend API exists,
+ * without touching AdminAuthService or components.
+ */
+export interface Ed25519Challenge {
+  nonce: string;
+  timestamp: string;
+  /** Opaque challenge payload the client must sign with its private key. */
+  payload: string;
+}
+
+export interface Ed25519SignedResponse {
+  challenge: Ed25519Challenge;
+  publicKey: string;
+  signature: string;
+}
+
+export interface Ed25519VerificationResult {
+  valid: boolean;
+  reason?: string;
+}
+
+export abstract class Ed25519VerificationService {
+  abstract requestChallenge(): Observable<Ed25519Challenge>;
+  abstract verify(response: Ed25519SignedResponse): Observable<Ed25519VerificationResult>;
+}

src/app/core/admin-auth/noop-ed25519-verification.service.ts

@@ -0,0 +1,20 @@
+import { Injectable } from '@angular/core';
+import { Observable, throwError } from 'rxjs';
+import { Ed25519Challenge, Ed25519SignedResponse, Ed25519VerificationResult, Ed25519VerificationService } from './ed25519-verification.model';
+
+/**
+ * Default DI binding for Ed25519VerificationService until the backend ships
+ * the real challenge/verify endpoints. Intentionally fails closed (throws)
+ * rather than pretending to verify anything, so accidental use in a login
+ * path is loud instead of silently accepting unsigned sessions.
+ */
+@Injectable({ providedIn: 'root' })
+export class NoopEd25519VerificationService implements Ed25519VerificationService {
+  requestChallenge(): Observable<Ed25519Challenge> {
+    return throwError(() => new Error('Ed25519 challenge endpoint is not yet available from the backend.'));
+  }
+
+  verify(_response: Ed25519SignedResponse): Observable<Ed25519VerificationResult> {
+    return throwError(() => new Error('Ed25519 verification endpoint is not yet available from the backend.'));
+  }
+}