openspec: laravel-admin change — Filament admin (users/tags/products/orders/dashboard) on shared Postgres

openspec/changes/laravel-admin/proposal.md

@@ -0,0 +1,34 @@
+## Why
+
+The product is owner-facing and working (Phases 1–3). What's missing is the **admin layer**: Where Woof needs a dashboard where the operator manages users, tags, products/orders, and sees what's happening (scans, alerts, lapsed payments). The 2014 system had this via `product_accounts`/`online_orders`; the schema for it (products, orders, tag linkage) was built in Phase 2.5 — Phase 4 delivers the management UI on top, as the long-planned **Laravel + Filament** system.
+
+## What Changes
+
+- **New Laravel app** (`admin/`) running via **Docker** on .27 for dev (php:8.3 + composer), connecting to the **shared Postgres** on `.13:5434` (same DB as the GOAT frontend — one source of truth).
+- **Auth**: admin login (Laravel session auth) gated to admin users; new `users.is_admin` flag (idempotent ALTER) so the same `users` table serves both owners and admins.
+- **Admin users**: list/search owner accounts, view details (tags, scans), suspend.
+- **Admin tags**: list all tags (registry + owned), view each tag's scans/alerts, **assign `product_id` + `order_id`** (the Phase 2.5 linkage), suspend/unsuspend.
+- **Products & orders**: CRUD product templates; record orders (status lifecycle pending/paid/lapsed/cancelled).
+- **Dashboard**: stats — tags by status, scans in last 24 h, recent scans, lapsed orders.
+- **No change** to the GOAT frontend or the shared schema beyond `users.is_admin`.
+
+## Capabilities
+
+### New Capabilities
+
+- `admin-auth`: admin login + gate; `users.is_admin`.
+- `admin-users`: manage owner accounts.
+- `admin-tags`: manage tags incl. product/order assignment + suspend.
+- `admin-products-orders`: CRUD products + orders.
+- `admin-dashboard`: operational stats.
+
+### Modified Capabilities
+
+- `database`: ADDED — `users.is_admin` column (idempotent).
+
+## Impact
+
+- **New**: `admin/` Laravel app (Filament panel), `admin/docker-compose.yml`, models (User, Tag, Scan, Product, Order), Filament resources, `.env` for the shared DB.
+- **Schema**: idempotent `ALTER TABLE users ADD COLUMN IF NOT EXISTS is_admin BOOLEAN NOT NULL DEFAULT FALSE;`
+- **Secrets**: `DB_*` env in `admin/.env` (gitignored); no real secrets committed.
+- No changes to the GOAT frontend code paths.