Security recovery: hold sweep, dashboard updates, and admin fixes.

frontend/src/app/admin/layout.tsx

@@ -62,6 +62,10 @@ export default function AdminLayout({
   const allowedPathsForRole = new Set(
     navigationWithRoles.filter((item) => item.allowedRoles.includes(userRole)).map((item) => item.href)
   );
+  // All known admin routes regardless of role, used only to tell "not allowed
+  // for this role" apart from "doesn't exist" - the latter should render the
+  // 404 page instead of bouncing to the default route.
+  const allAdminHrefs = new Set(navigationWithRoles.map((item) => item.href));
   const defaultAdminRoute =
     userRole === 'staff' ? '/admin/scanner' : userRole === 'marketing' ? '/admin/contacts' : '/admin';
 
@@ -79,11 +83,14 @@ export default function AdminLayout({
       router.replace(defaultAdminRoute);
       return;
     }
-    const isPathAllowed = (path: string) => {
-      if (allowedPathsForRole.has(path)) return true;
-      return Array.from(allowedPathsForRole).some((allowed) => path.startsWith(allowed + '/'));
+    const matchesHrefSet = (path: string, hrefs: Set<string>) => {
+      if (hrefs.has(path)) return true;
+      return Array.from(hrefs).some((href) => path.startsWith(href + '/'));
     };
-    if (!isPathAllowed(pathname)) {
+    // Unknown route entirely (e.g. a typo'd URL) - let it fall through to the
+    // admin 404 page instead of silently redirecting away.
+    if (!matchesHrefSet(pathname, allAdminHrefs)) return;
+    if (!matchesHrefSet(pathname, allowedPathsForRole)) {
       router.replace(defaultAdminRoute);
     }
   }, [pathname, userRole, defaultAdminRoute, router, user, hasAdminAccess]);