feat: admin org management API + member login fixes

Add NestJS endpoints the admin panel org UI was calling (all returning 404):
- GET/POST /admin/orgs — list and create organizations
- GET /admin/orgs/:id — org detail with tenants and orgAdmins
- POST /admin/orgs/:id/admins — create OrgAdmin with hashed password
- PATCH /admin/tenants/:id/org — assign/unassign tenant from org

Also ship the member login page and sidebar fix from the previous session:
- Move /my/login to /member-login to break infinite redirect loop
- Add /member-login to PUBLIC_PATHS in sidebar so it is not intercepted

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/modules/super-admin/admin-orgs.controller.ts

@@ -0,0 +1,50 @@
+import { Body, Controller, Get, Param, Patch, Post, UseGuards } from '@nestjs/common';
+import { IsOptional, IsString, MinLength } from 'class-validator';
+import { SuperAdminGuard } from './super-admin.guard';
+import { SuperAdminService } from './super-admin.service';
+
+class CreateOrgDto {
+  @IsString() @MinLength(2) slug!: string;
+  @IsString() @MinLength(1) name!: string;
+}
+
+class CreateOrgAdminDto {
+  @IsString() email!: string;
+  @IsString() @IsOptional() name?: string;
+  @IsString() @MinLength(8) password!: string;
+}
+
+class AssignTenantOrgDto {
+  @IsString() @IsOptional() organizationId?: string | null;
+}
+
+@UseGuards(SuperAdminGuard)
+@Controller('admin')
+export class AdminOrgsController {
+  constructor(private readonly service: SuperAdminService) {}
+
+  @Get('orgs')
+  listOrgs() {
+    return this.service.listOrgs();
+  }
+
+  @Post('orgs')
+  createOrg(@Body() body: CreateOrgDto) {
+    return this.service.createOrg(body.slug, body.name);
+  }
+
+  @Get('orgs/:id')
+  getOrg(@Param('id') id: string) {
+    return this.service.getOrg(id);
+  }
+
+  @Post('orgs/:id/admins')
+  createOrgAdmin(@Param('id') id: string, @Body() body: CreateOrgAdminDto) {
+    return this.service.createOrgAdmin(id, body.email, body.name, body.password);
+  }
+
+  @Patch('tenants/:id/org')
+  assignTenantToOrg(@Param('id') id: string, @Body() body: AssignTenantOrgDto) {
+    return this.service.assignTenantToOrg(id, body.organizationId ?? null);
+  }
+}

apps/api/src/modules/super-admin/super-admin.module.ts

@@ -2,6 +2,7 @@ import { Global, Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { SuperAdminController } from './super-admin.controller';
+import { AdminOrgsController } from './admin-orgs.controller';
 import { SuperAdminService } from './super-admin.service';
 import { SuperAdminGuard } from './super-admin.guard';
 import { PrismaModule } from '../../prisma/prisma.module';
@@ -18,7 +19,7 @@ import { PrismaModule } from '../../prisma/prisma.module';
       }),
     }),
   ],
-  controllers: [SuperAdminController],
+  controllers: [SuperAdminController, AdminOrgsController],
   providers: [SuperAdminService, SuperAdminGuard],
   exports: [SuperAdminGuard, JwtModule],
 })

apps/api/src/modules/super-admin/super-admin.service.ts

@@ -1,4 +1,4 @@
-import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConflictException, Injectable, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import * as bcrypt from 'bcryptjs';
@@ -32,4 +32,81 @@ export class SuperAdminService {
     if (!admin) throw new UnauthorizedException('Super admin not found');
     return { id: admin.id, email: admin.email, name: admin.name };
   }
+
+  async listOrgs() {
+    return this.prisma.organization.findMany({
+      orderBy: { createdAt: 'desc' },
+      select: {
+        id: true,
+        slug: true,
+        name: true,
+        createdAt: true,
+        _count: { select: { tenants: true, orgAdmins: true } },
+      },
+    });
+  }
+
+  async createOrg(slug: string, name: string) {
+    const existing = await this.prisma.organization.findUnique({ where: { slug } });
+    if (existing) throw new ConflictException(`Organization with slug "${slug}" already exists`);
+    return this.prisma.organization.create({
+      data: { slug, name },
+      select: { id: true, slug: true, name: true, createdAt: true },
+    });
+  }
+
+  async getOrg(id: string) {
+    const org = await this.prisma.organization.findUnique({
+      where: { id },
+      select: {
+        id: true,
+        slug: true,
+        name: true,
+        createdAt: true,
+        tenants: {
+          select: { id: true, slug: true, name: true, isActive: true, createdAt: true },
+          orderBy: { createdAt: 'desc' },
+        },
+        orgAdmins: {
+          select: { id: true, email: true, name: true, role: true, createdAt: true },
+          orderBy: { createdAt: 'desc' },
+        },
+      },
+    });
+    if (!org) throw new NotFoundException('Organization not found');
+    return org;
+  }
+
+  async createOrgAdmin(orgId: string, email: string, name: string | undefined, password: string) {
+    const org = await this.prisma.organization.findUnique({ where: { id: orgId } });
+    if (!org) throw new NotFoundException('Organization not found');
+
+    const existing = await this.prisma.orgAdmin.findUnique({
+      where: { organizationId_email: { organizationId: orgId, email } },
+    });
+    if (existing) throw new ConflictException('An admin with this email already exists in this organization');
+
+    const passwordHash = await bcrypt.hash(password, 10);
+    const admin = await this.prisma.orgAdmin.create({
+      data: { organizationId: orgId, email, name, passwordHash },
+      select: { id: true, email: true, name: true, role: true, createdAt: true },
+    });
+    return admin;
+  }
+
+  async assignTenantToOrg(tenantId: string, organizationId: string | null) {
+    const tenant = await this.prisma.tenant.findUnique({ where: { id: tenantId } });
+    if (!tenant) throw new NotFoundException('Tenant not found');
+
+    if (organizationId !== null) {
+      const org = await this.prisma.organization.findUnique({ where: { id: organizationId } });
+      if (!org) throw new NotFoundException('Organization not found');
+    }
+
+    return this.prisma.tenant.update({
+      where: { id: tenantId },
+      data: { organizationId },
+      select: { id: true, slug: true, name: true, organizationId: true },
+    });
+  }
 }

apps/web/app/_lib/sidebar.tsx

@@ -22,7 +22,7 @@ const SUPER_ADMIN_LINKS = [
   { href: '/admin/drafts', label: 'AI Drafts' },
 ];
 
-const PUBLIC_PATHS = ['/login', '/signup', '/onboard'];
+const PUBLIC_PATHS = ['/login', '/signup', '/onboard', '/member-login'];
 const ADMIN_PATHS = ['/admin'];
 const MEMBER_PATHS = ['/my'];
 

apps/web/app/my/layout.tsx

@@ -18,7 +18,7 @@ const NAV = [
 
 export default async function MemberLayout({ children }: { children: React.ReactNode }) {
   const token = await getMemberToken();
-  if (!token) redirect('/my/login');
+  if (!token) redirect('/member-login');
 
   return (
     <div className="flex h-full -m-6 min-h-screen">