feat(db): mesh data model — meshes, members, invites, audit log

- pgSchema "mesh" with 4 tables isolating the peer mesh domain
- Enums: visibility, transport, tier, role
- audit_log is metadata-only (E2E encryption enforced at broker/client)
- Cascade on mesh delete, soft-delete via archivedAt/revokedAt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/web/src/app/[locale]/admin/layout.tsx

@@ -0,0 +1,61 @@
+import { redirect } from "next/navigation";
+
+import { hasAdminPermission } from "@turbostarter/auth";
+import { Icons } from "@turbostarter/ui-web/icons";
+import { SidebarProvider } from "@turbostarter/ui-web/sidebar";
+
+import { pathsConfig } from "~/config/paths";
+import { getSession } from "~/lib/auth/server";
+import { AdminSidebar } from "~/modules/admin/layout/sidebar";
+import { DashboardInset } from "~/modules/common/layout/dashboard/inset";
+
+const menu = [
+  {
+    label: "admin",
+    items: [
+      {
+        title: "home",
+        href: pathsConfig.admin.index,
+        icon: Icons.Home,
+      },
+      {
+        title: "users",
+        href: pathsConfig.admin.users.index,
+        icon: Icons.UsersRound,
+      },
+      {
+        title: "organizations",
+        href: pathsConfig.admin.organizations.index,
+        icon: Icons.Building,
+      },
+      {
+        title: "customers",
+        href: pathsConfig.admin.customers.index,
+        icon: Icons.HandCoins,
+      },
+    ],
+  },
+];
+
+export default async function AdminLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  const { user } = await getSession();
+
+  if (!user) {
+    return redirect(pathsConfig.auth.login);
+  }
+
+  if (!hasAdminPermission(user)) {
+    return redirect(pathsConfig.dashboard.user.index);
+  }
+
+  return (
+    <SidebarProvider>
+      <AdminSidebar user={user} menu={menu} />
+      <DashboardInset>{children}</DashboardInset>
+    </SidebarProvider>
+  );
+}