docs(admin): phase 3a session log + roadmap status

docs/roadmap.md

@@ -1,7 +1,7 @@
 # Insole Production Time Tracker — Rebuild Roadmap & Project Overview
 
 - **Created:** 2026-06-17
-- **Status:** Approved — living project doc; Phases 0–2 implemented (`docs/plans/phase-2-accounts-roles.md`)
+- **Status:** Approved — living project doc; Phases 0–2 implemented + Phase **3a** implemented (`docs/superpowers/plans/2026-06-17-phase-3a-admin-panel.md`)
 - **Type:** Greenfield rebuild of an inherited app
 - **Tracked in git** under `docs/` (the project's documentation source of truth).
 
@@ -174,8 +174,16 @@ Each phase keeps the system working and is its own spec → plan → build cycle
   an admin account exists; admin manages users via `/api/auth/admin/*` and sees all sessions via
   `/api/admin/sessions`. Public sign-up is closed; activity writes are admin-only.
   _Done when:_ workers see only their own sessions; an admin account exists.
-- **Phase 3 — Admin panel.** The React admin app: live active-work view, reports/export,
-  user management, **activity management**, **manual entry/edit (the fallback)**.
+- **Phase 3 — Admin panel.** The React admin app (`apps/admin`, Vite + React, dev port
+  5174): live active-work view, reports/export, user management, **activity management**,
+  **manual entry/edit (the fallback)**.
+  **3a implemented** (`apps/admin`; plan `docs/superpowers/plans/2026-06-17-phase-3a-admin-panel.md`):
+  admin-only login (rejects non-admins via `role` on `/api/me`), the sidebar shell, the live
+  active-work view (`/api/admin/sessions/active`, 5 s auto-refresh, read-only), and activity
+  management (handelingen CRUD on `/api/activities`). **3b remaining:** reports/export
+  (all-users filtered CSV — current `/api/export` is self-scoped), user management
+  (better-auth `/api/auth/admin/*`), and manual entry/edit + admin stop/fix of a running
+  session (needs new backend endpoints).
   Activity management (add/edit/delete handelingen + their `insole_types`) was removed from the
   worker client in the Phase 2 follow-up because it is admin-only; it must be **ported here**. The
   backend already exists (`/api/activities` writes are admin-gated; `useActivities`/the legacy