shipped · Medium priority

Game Panel Admin Hardening

The private panel now sends no-store/noindex security headers from bootstrap, preserves safe protected-route returns after login, rejects external redirect targets, and revalidates active users and permissions on protected pages.