refactor(auth): replace JWT/password-lock with token guards

components/admin-guard.tsx

@@ -0,0 +1,42 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { useSearchParams } from 'next/navigation';
+import { authApi } from '@/lib/api';
+
+export default function AdminGuard({ children }: { children: React.ReactNode }) {
+  const params = useSearchParams();
+  const [state, setState] = useState<'checking' | 'ok' | 'denied'>('checking');
+
+  useEffect(() => {
+    let cancelled = false;
+    (async () => {
+      const adm = params.get('adm');
+      try {
+        if (adm) {
+          await authApi.session({ adm });
+          // strip the param from URL but keep route
+          const url = new URL(window.location.href);
+          url.searchParams.delete('adm');
+          window.history.replaceState({}, '', url.toString());
+        }
+        const who = await authApi.whoami();
+        if (cancelled) return;
+        if (who.role === 'admin') setState('ok');
+        else setState('denied');
+      } catch {
+        if (!cancelled) setState('denied');
+      }
+    })();
+    return () => { cancelled = true; };
+  }, [params]);
+
+  if (state === 'checking') return <div className="min-h-screen flex items-center justify-center text-gray-500">Verificando…</div>;
+  if (state === 'denied') return <div className="min-h-screen flex items-center justify-center text-center px-6">
+    <div>
+      <h1 className="text-2xl font-bold mb-2">Acesso restrito</h1>
+      <p className="text-gray-500">Adicione <code>?adm=&lt;token&gt;</code> à URL para entrar.</p>
+    </div>
+  </div>;
+  return <>{children}</>;
+}