admin: User implements FilamentUser (canAccessPanel=isAdmin) — fixes 403 in production

admin/app/app/Models/User.php

@@ -2,29 +2,39 @@
 
 namespace App\Models;
 
+use Filament\Models\Contracts\FilamentUser;
+use Filament\Panel;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 
-class User extends Authenticatable
+class User extends Authenticatable implements FilamentUser
 {
     use HasFactory, Notifiable;
 
-    protected $table = "users";
+    protected $table = 'users';
     public $timestamps = false; // shared schema: created_at only, set by DB default
-    protected $fillable = ["email", "password_hash", "name", "phone", "is_admin"];
+    protected $fillable = ['email', 'password_hash', 'name', 'phone', 'is_admin'];
-    protected $hidden = ["password_hash"];
+    protected $hidden = ['password_hash'];
-    protected $casts = ["is_admin" => "boolean"];
+    protected $casts = ['is_admin' => 'boolean'];
 
     public function getAuthPassword(): string
     {
         return $this->password_hash;
     }
 
+    /**
+     * Filament panel access — only admins may use the admin panel.
+     */
+    public function canAccessPanel(Panel $panel): bool
+    {
+        return $this->isAdmin();
+    }
+
     public function tags(): HasMany
     {
-        return $this->hasMany(Tag::class, "owner_id");
+        return $this->hasMany(Tag::class, 'owner_id');
     }
 
     public function isAdmin(): bool