Update pricing UX, billing flows, and API rules

admin-dashboard-plan.md

@@ -0,0 +1,61 @@
+# Admin Dashboard Plan (Power Control)
+
+This is the internal control panel used to keep Dewemoji **safe, clean, and reliable**.
+
+## Purpose
+
+- Moderate public keywords and votes.
+- Manage licenses and activations.
+- Monitor system health and data pipelines.
+
+## Phase 1 (MVP — must‑have)
+
+### 1) Public keyword moderation
+- View **public_pending** keyword queue.
+- Approve / reject / block keyword.
+- See emoji, language, proposer, vote counts.
+
+### 2) Abuse controls
+- Blocklist terms.
+- Quick “hide” keyword from public search.
+- Soft‑ban repeated abusive accounts.
+
+### 3) License management
+- Lookup by license key.
+- See activations (device_id, product).
+- Revoke activation or whole license.
+
+### 4) System health
+- Last JSON rebuild time.
+- Dataset counts (emojis, keywords).
+- API usage summary (daily).
+
+### 5) Price control (Personal plan)
+- Set IDR pricing for Monthly / Annual / Lifetime.
+- Optional USD display override (approx only).
+- Toggle payment rails (PayPal / QRIS).
+- Effective date + change log (who changed, when).
+
+## Phase 2 (Nice‑to‑have)
+
+- AI moderation log viewer.
+- Turnstile failure analytics.
+- Contributor leaderboard.
+- Email queue status.
+- Scheduled job history.
+- Pricing experiment history.
+
+## Suggested navigation
+
+- **Dashboard** (health, quick stats)
+- **Keywords** (pending + public)
+- **Licenses**
+- **Users**
+- **System** (jobs, JSON rebuild, logs)
+
+## Access control
+
+- Admin login uses **magic‑link/OTP session** + **role=admin** check.
+- `X-Admin-Token` is **dev/internal only** (disable in prod).
+- No IP allowlist required (dynamic ISP friendly).
+- Log all actions (who approved / rejected / revoked).