## Why

The product is owner-facing and working (Phases 1–3). What's missing is the **admin layer**: Where Woof needs a dashboard where the operator manages users, tags, products/orders, and sees what's happening (scans, alerts, lapsed payments). The 2014 system had this via `product_accounts`/`online_orders`; the schema for it (products, orders, tag linkage) was built in Phase 2.5 — Phase 4 delivers the management UI on top, as the long-planned **Laravel + Filament** system.

## What Changes

- **New Laravel app** (`admin/`) running via **Docker** on .27 for dev (php:8.3 + composer), connecting to the **shared Postgres** on `.13:5434` (same DB as the GOAT frontend — one source of truth).
- **Auth**: admin login (Laravel session auth) gated to admin users; new `users.is_admin` flag (idempotent ALTER) so the same `users` table serves both owners and admins.
- **Admin users**: list/search owner accounts, view details (tags, scans), suspend.
- **Admin tags**: list all tags (registry + owned), view each tag's scans/alerts, **assign `product_id` + `order_id`** (the Phase 2.5 linkage), suspend/unsuspend.
- **Products & orders**: CRUD product templates; record orders (status lifecycle pending/paid/lapsed/cancelled).
- **Dashboard**: stats — tags by status, scans in last 24 h, recent scans, lapsed orders.
- **No change** to the GOAT frontend or the shared schema beyond `users.is_admin`.

## Capabilities

### New Capabilities

- `admin-auth`: admin login + gate; `users.is_admin`.
- `admin-users`: manage owner accounts.
- `admin-tags`: manage tags incl. product/order assignment + suspend.
- `admin-products-orders`: CRUD products + orders.
- `admin-dashboard`: operational stats.

### Modified Capabilities

- `database`: ADDED — `users.is_admin` column (idempotent).

## Impact

- **New**: `admin/` Laravel app (Filament panel), `admin/docker-compose.yml`, models (User, Tag, Scan, Product, Order), Filament resources, `.env` for the shared DB.
- **Schema**: idempotent `ALTER TABLE users ADD COLUMN IF NOT EXISTS is_admin BOOLEAN NOT NULL DEFAULT FALSE;`
- **Secrets**: `DB_*` env in `admin/.env` (gitignored); no real secrets committed.
- No changes to the GOAT frontend code paths.