Add super admin console at /-/admin/

[ericokuma]

Adds an internal super admin console to web-admin at /-/admin/, giving non-technical staff (CS, account managers) a GUI for operations currently only available via rill sudo CLI commands.

• New route group /-/admin/ with superuser-gated auth guard (ListSuperusers check)
• Sidebar navigation layout with 11 sections across 5 groups (Overview, People, Billing & Plans, Resources, Advanced)
• Full pages for: Users (search/assume/delete), Billing (extend trial, set customer ID, repair, issues), Organizations (lookup, custom domain, join), Quotas (org + user), Projects (search, hibernate, redeploy), Whitelist (add/remove domains), Superusers (list/add/remove), Annotations (load/edit/save)
• Stub pages for Virtual Files and Runtime (engineer-leaning, deferred)
• "Admin" link in OrgHeader visible only to superusers
• 26 new files, ~2000 lines; all using existing Orval-generated API clients with TanStack Query

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
• Intend to cherry-pick into the release branch
• I'm proud of this work!

---

Developed in collaboration with Claude Code

[ericokuma]

Re-review: Issues Found & Fixed

After re-reviewing the current state of the PR, I identified and fixed the following issues:

Fixed in this pass

1. Auth guard control flow clarity (+layout.ts): Restructured the catch block so redirectToLogin() is only called inside the 401 branch, with non-401 errors always throwing a redirect. Same behavior, clearer intent.

2. Unreachable code (+page.svelte Users): Removed notifySuccess() call after assumedUser.assume() — since assume() sets window.location.href, the notification never displays.

3. Unfiltered invalidateQueries() (superusers/+page.svelte): Both add and remove handlers called queryClient.invalidateQueries() with no filter, invalidating every query in the app. Scoped to /v1/superuser queries.

4. Unfiltered invalidateQueries() (billing/+page.svelte): handleDeleteIssue invalidated all queries. Scoped to /v1/organizations and /v1/superuser/billing.

5. ConfirmDialog closes on error (ConfirmDialog.svelte): If onConfirm threw, the dialog would close via the finally block, hiding the error. Added a catch block so the dialog stays open on failure, letting users retry or cancel.

Not applicable

• Annotations page, whitelist page, and OrgHeader component do not exist in the current diff — these were false positives from the earlier review.
• superuserForceAccess on getOrgProjects: the AdminServiceListProjectsForOrganizationParams type does not include this field, so no change needed.

---

Developed in collaboration with Claude Code

[ericokuma]

https://www.loom.com/share/c2371a742c5446ed8f33bd2f2da311b9

[royendo]

ill play with in Monday but from the Video a few comments:
Billing

• Not sure we need to surface Billing customer ID, very niche; also repair not sure what this does even with the description
  Orgs
• add ability to assume from there (Maybe thats already there but couldnt see in video)

Projects

• is this iterating through all orgs; probably fine but as you saw lots of duplicate project names might be confusing
• Add ability to change prod slots
  rill sudo project edit --prod-slots 4
  Quotas dont actually set the prod slots; those are just maxes