Build a locked admin panel to manage products

Context: this project is the online store "Thread & Needle", a fashion e-commerce store selling women's and men's clothing, shoes and accessories in United States and charging in USD. It uses Next.js (App Router), TypeScript, Tailwind CSS, PostgreSQL with Drizzle (local database shop_local), Zod and Auth.js with a role column (customer or admin). Product pages, Cloudinary signed uploads (Episode 9), accounts, checkout, payments and email already exist.

Goal: build an admin area at /admin where I manage categories, products and variants. Before coding, read the docs for the Next.js version in this project, especially how routing protection (middleware or proxy), server actions and route handlers work in that version, because they change between versions.

Plan first: show me your plan (routes, files, any database changes) and wait for my OK before changing anything. Explain "role", "server action" and "audit log" in a few plain words.

Tasks, after I approve:
1. Access control, in layers. Layer one: block /admin for anyone who is not signed in as an admin. Layer two, and the one that really matters: check the admin role again inside every server action, route handler and data query used by the admin. Never rely on hiding links. Non-admins get a plain not-found or forbidden page that reveals nothing.
2. Creating the first admin: do not build a public way to become admin. Write a one-time script that promotes an existing account whose email I type in the terminal. Show me how to run it against shop_local only.
3. Categories: list, create, edit, archive. Unique readable slugs.
4. Products: list with search, status filter and pagination; create and edit forms with name, slug, description, category, status (draft or published), and images. Only published products appear in the shop. Drafts are visible to admins only.
5. Variants (for example size and colour, or whatever fits women's and men's clothing, shoes and accessories): each has its own SKU, price, stock count and optional image. Money is stored as whole numbers in the smallest unit of USD; the form lets me type normal amounts. Block negative prices and negative stock.
6. Images: reuse the existing Cloudinary signed upload from Episode 9, so the upload signature is created on the server and only for admins. Validate file type and size, and store the image id and delivery URL.
7. Deleting: products that appear in any order must be archived, never deleted, so old orders stay intact.
8. Validation: every form and action uses a Zod schema on the server. Return clear field errors. Escape or reject unsafe content in descriptions.
9. Audit log: a table recording who (admin id), what (create, update, publish, archive), which item, a short before-and-after summary and the time. Never record passwords, tokens or keys. Add a simple read-only audit log page.
10. Keep the admin pages simple, mobile friendly and consistent with our design system.

Security rules: no secrets in code or logs; do not trust ids or prices from forms without validation; protect every state-changing action against cross-site request forgery as the framework recommends; return generic errors.

Verify yourself and show results: Vitest tests proving a customer account and a signed-out visitor are refused by each admin action; tests for the product Zod schema; then run the type check and linter. Start the site, create one draft product with two variants and an image, publish it, and confirm it appears in the shop only after publishing and that the audit log shows both steps.

Commit to a branch named feature/admin-products with a clear message.

Report back in this format: 1) What was done. 2) What I should check in the browser. 3) Anything that needs my decision.

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.