Admin: gestión de sitios de voto (home_votesite)

- lib/admin-votes.ts: listVoteSites / createVoteSite / deleteVoteSite.
- Routes /api/admin/votes (POST) y /api/admin/votes/[id] (DELETE), guard isAdmin.
- Página /admin/votes (AdminVotesManager: crear/listar/borrar) + enlace en dashboard.
- Conecta con la página de votación (/vote-points) ya existente.

Verificado: guardas (307/403), CRUD del write layer OK (con env cargado).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web-next/app/api/admin/votes/[id]/route.ts

@@ -0,0 +1,11 @@
+import { getSession } from '@/lib/session'
+import { isAdmin } from '@/lib/admin'
+import { deleteVoteSite } from '@/lib/admin-votes'
+
+export async function DELETE(_request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  const { id } = await params
+  await deleteVoteSite(Number(id))
+  return Response.json({ success: true })
+}

web-next/app/api/admin/votes/route.ts

@@ -0,0 +1,17 @@
+import { getSession } from '@/lib/session'
+import { isAdmin } from '@/lib/admin'
+import { createVoteSite } from '@/lib/admin-votes'
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!(await isAdmin(session))) return Response.json({ success: false, error: 'forbidden' }, { status: 403 })
+  let b: Record<string, unknown> = {}
+  try { b = await request.json() } catch { return Response.json({ success: false, error: 'invalidRequest' }, { status: 400 }) }
+  const name = String(b.name ?? '').trim()
+  const url = String(b.url ?? '').trim()
+  const imageUrl = String(b.imageUrl ?? '').trim()
+  const points = Number(b.points)
+  if (!name || !url || !(points >= 0)) return Response.json({ success: false, error: 'emptyError' })
+  const id = await createVoteSite(name, url, imageUrl, points)
+  return Response.json({ success: true, id })
+}