Refresh repository documentation

- Rewrite AGENTS and README files to match the current app layout
- Document API routes, trivia UI, and the active panel design language

panel/AGENTS.md

@@ -1,31 +1,87 @@
-# Panel (Admin Dashboard)
+# Panel
 
 ## Stack
-- React 19 + React Router v7 + Tailwind CSS v4 (Vite plugin) + Lucide icons.
-- No component library (no Radix, no shadcn). All styling is inline Tailwind.
-- No external state management. All state via custom hooks (`useAuth`, `useUsers`, `useItems`, `useDashboard`, `useGameRoom`).
 
-## API Client
-- Thin `fetch` wrapper in `src/lib/api.ts` with typed generics: `get`, `post`, `put`, `del`.
-- Credentials: `same-origin` only — CORS requests will fail.
-- 401 responses redirect to Discord auth. No retry logic.
-- 204 / empty responses return `undefined`.
+- React 19
+- React Router 7
+- Vite 6
+- Tailwind CSS v4 via `@tailwindcss/vite`
+- Local utilities: `clsx`, `tailwind-merge`, `class-variance-authority`
+- Icons: `lucide-react`
 
-## WebSocket
-- Singleton pattern in `useWebSocket()`. Global handler Set — multiple hooks share one connection.
-- Auto-reconnects with exponential backoff (max 30s).
-- `send()` and `subscribe()` API for components.
+The panel lives in `panel/src` and is built to `panel/dist`.
 
-## Patterns
-- **Draft editing:** Pages use `selectedUser → userDraft` flow. Changes aren't auto-saved. `saveDraft()` commits, `discardDraft()` reverts, `isDirty()` detects changes.
-- **Debounced search:** 300ms debounce on search inputs.
-- **No cache invalidation:** After mutations, manually call `refetch()` to update lists.
+## Dev and runtime
 
-## Routing
-- Role-based: player routes (`/dashboard`, `/games`, `/leaderboards`) and admin routes (`/admin/*`).
-- Sidebar auto-hides admin routes for non-admins.
+- `bun run panel:dev` starts Vite on `http://localhost:5173`
+- Vite proxies `/api`, `/auth`, `/assets`, and `/ws` to `http://localhost:3000`
+- The Bun server serves the built panel from `panel/dist` in integrated mode
 
-## Theme
-- Dark theme with "Celestial Gold" primary (`#e9c349`).
-- Semantic colors: destructive, success, warning, info.
-- 4-tier surface hierarchy. Utility: `cn()` from `clsx + tailwind-merge`.
+## Auth model
+
+- `useAuth()` calls `GET /auth/me`
+- unauthenticated users are sent through `/auth/discord`
+- logout uses `POST /auth/logout`
+- non-enrolled users see the `NotEnrolled` page
+
+Roles:
+
+- `admin`: admin routes plus player/game routes
+- `player`: player/game routes only
+
+## Active routes
+
+- `/dashboard`
+- `/leaderboards`
+- `/games`
+- `/:gameSlug/:roomId`
+- `/admin`
+- `/admin/users`
+- `/admin/items`
+- `/admin/classes`
+- `/admin/quests`
+- `/admin/lootdrops`
+- `/admin/moderation`
+- `/admin/transactions`
+- `/admin/settings`
+
+## Data layer
+
+Shared hooks in `panel/src/lib`:
+
+- `useAuth`
+- `useDashboard`
+- `useUsers`
+- `useItems`
+- `useSettings`
+- `useWebSocket`
+- `useGameRoom`
+
+`panel/src/lib/api.ts` is a thin fetch wrapper:
+
+- base path is empty because the panel is usually same-origin with the Bun server
+- 401 triggers a redirect back into `/auth/discord`
+- 204 and empty responses return `undefined`
+
+## WebSocket and games
+
+- `useWebSocket()` keeps a singleton browser WebSocket connection
+- reconnects with exponential backoff up to 30 seconds
+- `useGameRoom()` multiplexes room traffic over that shared socket
+- current built-in game UIs are chess and blackjack
+
+## Styling
+
+- Theme tokens live in `panel/src/index.css`
+- Fonts currently loaded:
+  - Noto Serif
+  - Manrope
+  - Space Grotesk
+  - JetBrains Mono
+- The implemented visual system is the "Stellar Editorial" direction documented in `docs/new-design/DESIGN.md`
+
+## Current patterns
+
+- Admin pages tend to use explicit `refetch()` after mutations instead of a shared cache layer
+- Search inputs use a 300 ms debounce in hooks such as `useUsers()` and `useItems()`
+- Layout and sidebar ownership lives in `panel/src/components/Layout.tsx`