Fix scoped admin access across admin pages and flagged activity actions

[prazgaitis]

Summary

• align challenge admin authorization checks across admin pages with isUserChallengeAdmin
• fix flagged activity admin mutations to authorize challenge admins (not only global admins)
• add investigation task log for production validation

What was wrong

A prior PR updated admin layout gating, but several nested admin pages and backend flagged-activity mutations still used global-admin/creator checks. That left scoped challenge admins blocked in parts of the admin flow.

Changed files

• apps/web/app/challenges/[id]/admin/activity-types/page.tsx
• apps/web/app/challenges/[id]/admin/integrations/page.tsx
• apps/web/app/challenges/[id]/admin/flagged-activities/page.tsx
• apps/web/app/challenges/[id]/admin/flagged-activities/[activityId]/page.tsx
• packages/backend/mutations/admin.ts
• tasks/2026-02-17-admin-scope-prod-verification.md
• .claude/napkin.md

Verification

• pnpm -F web typecheck
• pnpm -F backend exec tsc --noEmit
• precommit checks passed on commit (turbo lint typecheck --affected)

Prod data validation done during investigation

• confirmed users record for prazgaitis@gmail.com exists with role admin
• confirmed participation rows checked in prod include challenge admin role where expected

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
march-fitness-2025	Ready	Preview, Comment	Feb 17, 2026 4:29pm