update adming js

.cursor/rules/adminjs.mdc

@@ -0,0 +1,26 @@
+---
+description: AdminJS panel must stay in sync with Prisma schema changes
+globs: backend/src/admin/**,backend/prisma/schema.prisma,backend/prisma/migrations/**
+alwaysApply: false
+---
+
+# AdminJS ↔ Prisma sync (required)
+
+Ops panel at `/admin` (`backend/src/admin/`). Resources are a **manual allowlist** — Prisma does **not** auto-update AdminJS.
+
+## When you change `schema.prisma`
+
+**Before finishing the task**, update AdminJS:
+
+1. Open [`backend/src/admin/resources.ts`](backend/src/admin/resources.ts) (`buildAdminResources`).
+2. **New model** ops may need to inspect/fix → add `resource(...)` + navigation group + hide secrets.
+3. **Renamed / removed model** → update or remove the matching resource (broken `getModelByName` breaks `/admin` boot).
+4. **New secret fields** (hashes, tokens, share tokens) → hide via `isVisible: false` (list/filter/show/edit).
+5. **Catalog-like reference data** → list/show/edit only; disable `new` / `delete` / `bulkDelete`.
+6. Skip pure join/cursor tables unless ops need them (`LabCaseUserReadState`, `LabCaseUserTabReadState`, working-hours, `LabCaseAttachment`).
+
+Auth: `ADMINJS_EMAIL` / `ADMINJS_PASSWORD` — production login disabled if password missing or still `admin123`.
+
+## Secrets to hide
+
+`passwordHash`, session `token`/`refreshToken`, invite/OTP `tokenHash`/`codeHash`, `LabCase.accessToken`.