Session 18: Admin dashboard + Tank01 prefetch endpoint (1443 tests)

src/app.js

@@ -22,6 +22,7 @@ const shareCardRoutes = require('./routes/shareCard');
 const pushRoutes = require('./routes/push');
 const gradingRoutes = require('./routes/grading');
 const correctionRoutes = require('./routes/corrections');
+const internalRoutes = require('./routes/internal');
 const { missionHeader } = require('./middleware/mission');
 
 const app = express();
@@ -137,6 +138,11 @@ app.use('/api/grading', express.json({ limit: '10mb' }), gradingRoutes);
 app.use('/api/grading', express.json({ limit: '256kb' }), correctionRoutes);
 const widgetRoutes = require('./routes/widget');
 app.use('/api/widget', widgetRoutes);
+// Session 18 — internal ops endpoints (admin dashboard triggers,
+// shared-key auth via `VYNDR_INTERNAL_KEY`). Never reachable from
+// the public surface; the Next.js admin route proxies through with
+// the key kept server-side.
+app.use('/api/internal', internalRoutes);
 
 // Session 10 — Sentry's Express error handler catches uncaught
 // errors from every route mounted above. Must come AFTER routes but