feat(admin): drop the unscoped control-plane login branch

HQ sign-in names no instance, so a lookup of control-plane users by email
alone cannot be scoped — and users.email is no longer globally unique, so
it would return an arbitrary match. Every customer authenticates against
customer_users instead.

Legacy cloud customers get an HQ login from staff via the new
POST /api/staff/accounts/:id/users, alongside the manual instance attach
the spec README already describes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/internal/api/routes.go

@@ -27,7 +27,11 @@ func Routes(cfg config.Config) http.Handler {
 	r.GET("/healthz", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"ok": true}) })
 
 	r.POST("/auth/staff/login", auth.HandleStaffLogin)
-	r.POST("/auth/login", auth.HandleCloudLogin) // falls through to customer login
+	// Every customer authenticates against admin's own customer_users. There is
+	// deliberately no path that looks a customer up in the control plane by
+	// email alone: HQ sign-in names no instance, so such a lookup could not be
+	// scoped, and users.email is no longer globally unique.
+	r.POST("/auth/login", auth.HandleCustomerLogin)
 	r.POST("/auth/logout", auth.HandleLogout)
 	r.GET("/auth/verify", auth.HandleVerify)
 	r.GET("/auth/me", getMe)
@@ -50,6 +54,7 @@ func Routes(cfg config.Config) http.Handler {
 		staff.GET("/accounts", staffListAccounts)
 		staff.POST("/accounts", staffCreateAccount)
 		staff.GET("/accounts/:id", staffGetAccount)
+		staff.POST("/accounts/:id/users", staffCreateAccountUser)
 		staff.GET("/instances", staffListInstances)
 		staff.POST("/instances", staffCreateInstance)
 		staff.GET("/instances/:id", staffGetInstance)

admin/internal/api/staff.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -448,3 +449,40 @@ func staffInjectionHealth(c *gin.Context) {
 	}
 	c.JSON(http.StatusOK, gin.H{"failed": failed, "count": len(failed)})
 }
+
+// staffCreateAccountUser gives an account an HQ login.
+//
+// This is how a legacy cloud customer — one whose instance predates HQ accounts
+// — gets into the portal, alongside the manual instance attach the spec README
+// describes. It reuses CreateCustomerUser, so the row is unverified until the
+// emailed link is opened and is rolled back if that email cannot be sent.
+func staffCreateAccountUser(c *gin.Context) {
+	var body struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Email == "" || len(body.Password) < 12 {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error": "email and a password of at least 12 characters are required"})
+		return
+	}
+	ctx := c.Request.Context()
+	accountID := c.Param("id")
+
+	if n, err := db.Admin("accounts").CountDocuments(ctx,
+		bson.M{"account_id": accountID}); err != nil || n == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "no such account"})
+		return
+	}
+
+	email := strings.ToLower(strings.TrimSpace(body.Email))
+	if err := auth.CreateCustomerUser(ctx, accountID, email, body.Password); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	s := auth.Current(c)
+	audit.Write(ctx, models.AuditEntry{
+		Actor: s.Email, Action: "customer_user.created", AccountID: accountID, Target: email})
+	c.JSON(http.StatusCreated, gin.H{"pending": true})
+}