Epic: Build Studio and an admin API with management parity

[alexeygrigorev]

Normative spec: 06 — Studio and admin API

Outcome

Provide /studio/ and /api/v1/admin/ as two safe adapters over the same services, permissions, validation, concurrency controls, idempotency rules, and append-only audit trail.

Boundaries

Django admin is break-glass only. Studio does not need browser-side API self-calls; code-level service and capability parity is required.

Epic completion gate

• Capability registry covers every management action and CI detects parity drift.
• Role/object/field permissions, staff sessions, and scoped hashed API principals pass positive and negative tests.
• OpenAPI covers all routed management operations and long-running operations have resources.
• High-risk actions, exports, stale writes, retries, and audits behave consistently.

Dependencies

Foundation starts after #1; domain-specific management screens depend on their domain services. Decision-free Studio authorization/audit primitives are extracted into #86; production identity and final high-risk completion remain gated by #20/#28 through #32.

Child issues

• Decision: Select the staff OIDC provider and break-glass policy #20
• Decision: Confirm high-risk action approvals and reauthentication #28
• Add shared service, configuration, operation, and durable-job primitives #31
• Add the decision-free Studio authorization and audit foundation #86
• Complete Studio production identity, role, audit export, and high-risk controls #32
• Complete production admin API identity and credential lifecycle controls #33
• Build secure GitHub webhook, reconciliation, candidate sync, preview, and activation #38
• Add event registration operations, attendance, exports, and change notifications #47
• Manage Relay-owned versioned transactional templates in Studio #48
• Build the durable Relay delivery intent and status lifecycle #49
• Replace global course staff access and plaintext API tokens with scoped capabilities #52
• Move all course operations into Studio and the admin API #59
• Integrate staff OIDC/MFA login, session lifecycle, and break-glass recovery #61
• Manage navigation, announcements, sponsors, redirects, and safe site settings #62