Admin app shell (subdomain or path)

Ship a minimal admin entry point so engineering can mount admin UIs incrementally—not a full admin product in one pass.
Host admin at admin.attik.ai (confirmed Mar 17) with routing and layout so Payroll and Client Care Dashboard (separate projects) can plug into the same shell over time.
Keep scope thin: app structure + basic shell; detailed navigation and menus are covered in ATT-1017.

Today the Next.js app routes by hostname in attik-frontend/next.config.js: e.g. app.attik.ai / attik.ai / staging.attik.ai rewrite to /tools/*, client.attik.ai to /client/*, signup.attik.ai to /signup/*. There is no admin.attik.ai entry yet—admin needs the same kind of host → segment wiring plus a layout.
The tools shell (attik-frontend/src/app/tools/layout.tsx) loads auth(), Navbar, InPageNav, and wraps children in Provider. Client Care Dashboard may be greenfield (no existing admin rails); the admin shell can reuse patterns from tools or introduce a lighter layout—Decision needed per product.
Sequencing: Admin should use the same auth/token stack as the main app once ATT-1016 lands; building the shell before shared session alignment risks rework on cookies and session.
ATT-1017 adds nav/menus (including reusing NavUser for company switch); this ticket is the shell + route home for admin.

Frontend

Add admin routing consistent with existing host rewrites: e.g. a new admin.attik.ai → /admin/:path* (or equivalent) rule alongside current entries in next.config.js, plus an src/app/admin/ (or agreed segment) layout that provides a minimal shell (providers, auth gate placeholder, outlet for child routes).
Ensure the shell is safe to extend for Payroll and Client Care Dashboard routes without dictating their internal structure.
Infrastructure / config (DNS, Vercel/host allowlist, env) may need to recognize admin.attik.ai—coordinate with deploy setup; Decision needed for local dev hostname (e.g. admin.localhost pattern if used elsewhere).

Backend

No dedicated admin API is required for shell-only work; session validation continues to follow whatever ATT-1016 establishes for cross-subdomain tokens.

Attik