feat(app): wire dashboard administration flows

ts/readme.md

@@ -1,6 +1,6 @@
 # `ts/` Backend Module
 
-The `ts/` folder contains the server runtime for `idp.global`: startup, website server wiring, typed routes, OIDC endpoints, and the core `Reception` managers.
+The `ts/` folder contains the server runtime for `idp.global`: startup, website server wiring, typed routes, OIDC endpoints, passport approval APIs, alerting, and the core `Reception` managers.
 
 ## Issue Reporting and Security
 
@@ -10,7 +10,7 @@ For reporting bugs, issues, or security vulnerabilities, please visit [community
 
 - `index.ts` boots the service, loads env vars, starts the website server, and mounts OIDC endpoints.
 - `reception/classes.reception.ts` creates the service container and initializes all managers.
-- `reception/` contains the domain logic for users, sessions, orgs, roles, invites, apps, billing, and OIDC.
+- `reception/` contains the domain logic for users, sessions, orgs, roles, invites, apps, billing, passport devices, alerts, abuse protection, and OIDC.
 - `plugins.ts` centralizes external imports used by the backend.
 
 ## Startup Behavior
@@ -32,7 +32,7 @@ export INSTANCE_NAME=idp-dev
 
 Optional:
 
-- `SERVEZONE_PLATFROM_AUTHORIZATION`
+- `SERVEZONE_PLATFORM_AUTHORIZATION`
 - `PADDLE_TOKEN`
 - `PADDLE_PRICE_ID`
 
@@ -51,8 +51,22 @@ Optional:
 | `AppManager` | Global app administration |
 | `AppConnectionManager` | App connection tracking |
 | `ActivityLogManager` | User activity logging |
+| `AlertManager` | Passport alerts and alert rule management |
+| `AbuseProtectionManager` | Attempt windows and temporary blocks for sensitive flows |
+| `PassportManager` | Trusted device enrollment, approval challenges, dashboard data, and signed device requests |
+| `PassportPushManager` | Push notification delivery hooks for passport challenges and alerts |
 | `OidcManager` | OIDC discovery, auth code flow, token exchange, userinfo, revoke |
 
+## Passport Request Surface
+
+The backend exposes signed-device workflows over the same `typedrequest` router as the rest of the service:
+
+- enrollment: `createPassportEnrollmentChallenge`, `completePassportEnrollment`
+- devices: `getPassportDevices`, `revokePassportDevice`, `registerPassportPushToken`
+- challenges: `createPassportChallenge`, `approvePassportChallenge`, `rejectPassportChallenge`, `listPendingPassportChallenges`
+- dashboard and hints: `getPassportDashboard`, `getPassportChallengeByHint`, `markPassportChallengeSeen`
+- alerts: `listPassportAlerts`, `getPassportAlertByHint`, `markPassportAlertSeen`, `dismissPassportAlert`
+
 ## Local Development
 
 From the repository root: