admin-login page + single parameterized auth-error-page covering all 5 error codes; auth.routes.ts registered top-level (not linked from live nav yet). Also closes a real gap: /edit and /edit/:section had no adminAuthGuard at all - now protected like /backoffice.