-
Single shared password (.env ADMIN_PASSWORD) + in-memory HttpOnly session cookie, no accounts/roles — MVCP M.1/M.10's real account system supersedes this in period 3. Covers the existing /api/admin/library/* routes (previously unauthenticated, see architecture.md 1.2's tech-debt note) plus the new upload endpoint. admin.html gets a fetch() interceptor that redirects to the new admin-login.html on any 401 from /api/admin/*, rather than patching every call site.
-
Static video-gen testing tool (MiniMax native API, then fal.ai) that grew into an AI drama live channel backed by an internal H3 Console GPU cluster: shared virtual-playhead live playback, prompt submit/match/generate queue, admin CRUD for the video library, and bilingual (zh/en) semantic clip names. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>