Merge branch 'main' into opencode/sunny-orchid

# Conflicts:
#	README.md

frontend/src/stores/__tests__/auth.spec.ts

@@ -105,4 +105,21 @@ describe('auth store logout', () => {
     expect(store.user).toBeNull()
     expect(store.token).toBeNull()
   })
+
+  it('separates admin access from admin operations for audit administrators', () => {
+    const store = useAuthStore()
+
+    store.user = {
+      id: 'audit-1',
+      username: 'auditor',
+      role: 'audit_admin',
+      is_active: true,
+      created_at: '2026-03-16T00:00:00Z',
+    }
+
+    expect(store.isAdmin).toBe(false)
+    expect(store.isAuditAdmin).toBe(true)
+    expect(store.canAccessAdmin).toBe(true)
+    expect(store.canOperateAdmin).toBe(false)
+  })
 })

frontend/src/stores/auth.ts

@@ -32,6 +32,9 @@ export const useAuthStore = defineStore('auth', () => {
     }
   }
   const isAdmin = computed(() => user.value?.role === 'admin')
+  const isAuditAdmin = computed(() => user.value?.role === 'audit_admin')
+  const canAccessAdmin = computed(() => isAdmin.value || isAuditAdmin.value)
+  const canOperateAdmin = computed(() => isAdmin.value)
 
   async function login(email: string, password: string, authType: 'local' | 'ldap' = 'local') {
     loading.value = true
@@ -114,6 +117,9 @@ export const useAuthStore = defineStore('auth', () => {
     error,
     isAuthenticated,
     isAdmin,
+    isAuditAdmin,
+    canAccessAdmin,
+    canOperateAdmin,
     login,
     logout,
     applyExternalLogout,