Update pricing UX, billing flows, and API rules

dewemoji-admin-walkthrough.md

@@ -0,0 +1,115 @@
+# Dewemoji Admin Dashboard Walkthrough
+
+This guide explains how to access and operate the admin dashboard, plus how each section is wired in the current build.
+
+## Access
+
+1. Sign in with an admin user (role `admin`).
+2. Navigate to `/dashboard/admin/*` routes.
+3. The sidebar automatically shows admin navigation when the session user is admin.
+
+## Admin Sections
+
+### Analytics
+
+Route: `/dashboard/admin/analytics`  
+What it shows:
+- User totals, active subscriptions, webhook counts
+- Recent webhook events
+
+Data source:
+- Direct database counts via `AdminDashboardController::analytics()`
+
+### Users
+
+Route: `/dashboard/admin/users`  
+What it shows:
+- User list (latest 50)
+- Filters: search, tier, role
+- Inline tier update (free/personal)
+
+Actions:
+- Update tier: POST `/dashboard/admin/users/tier`
+
+### Subscriptions
+
+Route: `/dashboard/admin/subscriptions`  
+What it shows:
+- Subscription list (latest 50)
+- Grant/revoke forms
+
+Actions:
+- Grant: POST `/dashboard/admin/subscriptions/grant`
+- Revoke: POST `/dashboard/admin/subscriptions/revoke`
+
+Notes:
+- Granting an active subscription automatically sets user tier to `personal`.
+- Revoking updates the user tier based on remaining active subscriptions.
+
+### Pricing
+
+Route: `/dashboard/admin/pricing`  
+What it shows:
+- Pricing plans with editable fields
+- Change log (latest 5)
+
+Actions:
+- Update pricing: POST `/dashboard/admin/pricing/update`
+- Reset to defaults: POST `/dashboard/admin/pricing/reset`
+
+Notes:
+- Updates are stored in `pricing_plans`.
+- Each change logs a snapshot to `pricing_changes`.
+
+### Webhooks
+
+Route: `/dashboard/admin/webhooks`  
+What it shows:
+- Recent webhook events (latest 50)
+- Replay action per event
+
+Actions:
+- Replay: POST `/dashboard/admin/webhooks/{id}/replay`
+
+Notes:
+- Replay marks the event as `pending`. (Actual processing should be handled by the webhook processor job/worker.)
+
+### Settings
+
+Route: `/dashboard/admin/settings`  
+What it shows:
+- Current environment config summaries
+- Editable settings for public access + maintenance mode
+
+Actions:
+- Update settings: POST `/dashboard/admin/settings/update`
+
+Settings stored:
+- `maintenance_enabled` (bool)
+- `public_enforce` (bool)
+- `public_origins` (array)
+- `public_extension_ids` (array)
+- `public_hourly_limit` (int)
+
+## Admin Routes Reference
+
+- GET `/dashboard/admin/analytics`
+- GET `/dashboard/admin/users`
+- POST `/dashboard/admin/users/tier`
+- GET `/dashboard/admin/subscriptions`
+- POST `/dashboard/admin/subscriptions/grant`
+- POST `/dashboard/admin/subscriptions/revoke`
+- GET `/dashboard/admin/pricing`
+- POST `/dashboard/admin/pricing/update`
+- POST `/dashboard/admin/pricing/reset`
+- GET `/dashboard/admin/webhooks`
+- POST `/dashboard/admin/webhooks/{id}/replay`
+- GET `/dashboard/admin/settings`
+- POST `/dashboard/admin/settings/update`
+
+## Notes for Future Wiring
+
+- Replace placeholder analytics charts with real metrics/graphs.
+- Add pagination + sorting for users, subscriptions, and webhooks.
+- Add confirmation dialogs for destructive actions.
+- Wire replay to actual processor/job queue if needed.