Board: admins edit everything + announcement emails

[getvindicated2day]

What this does

Admins can edit everything, per chapter. Signed in with a chapter's admin password, every part of that chapter's hub has an Edit link:

• Members: add, edit or remove, including a new Hub admin checkbox.
• Teams: add, rename or remove. Removing a team that has members asks where to move them.
• The Projects tab: descriptions and every week of the timeline.
• Home: quick links, key dates and the photo row (upload, replace, reorder, remove).
• Assignments (including past weeks), announcements, meetings and events.
• The subtitle, the board meeting time, and Berkeley's rule.

Edited content lives in a new board_settings table, seeded from the current defaults. Members never see edit controls.

Change log. The server checks every edit against that chapter's admin session and logs it to board_changelog. The new admin-only Changes tab shows what changed and has Restore previous version on each entry. If a later change touched the same item, it warns that restoring also undoes that. An optional "Your name" box is saved per browser, and the log marks it as self-reported.

Hub admin. The checkbox starts ticked for Fiona and Will (UCLA) and Rana (Berkeley). Only admins can change it, and every change is logged.

Announcement emails.

• "Email this to everyone" is on by default for a new post. The form shows how many people will get it and lists anyone with no email on file. You confirm with "Send to N people?".
• Brevo sends one email per person, so no one sees anyone else's address. The subject is [VINdicated UCLA] <title> or [VINdicated Berkeley] <title>. The email has the text plus a link to the hub, comes from BOARD_INVITE_FROM, and replies go to the organizer.
• Admins-only announcements go to Hub admins only.
• "Send me a test" goes to any address you type.
• Editing offers "Email the update" (off by default, subject starts "Updated:"). Deleting sends nothing.
• Admins see "Emailed to N people on ". Failed sends are listed with a Retry button.

Tested (local production build, Brevo replaced by a stub)

• A UCLA admin changed a member's role, a timeline week and a quick link. Each change showed on the page and in the change log, with the self-reported name.
• A UCLA member's session and a Berkeley admin's session were refused (404) on every edit, restore, email, test-send and photo-upload route. Berkeley can't restore or email UCLA rows, and UCLA can't touch Berkeley's.
• Posting sent 9 separate emails, each with one To address and no Cc or Bcc. A simulated failure was recorded, and Retry then reached that person.
• An admins-only announcement reached only Fiona and Will. An edit with the box ticked went out as "Updated: ...". Deleting sent nothing.
• Restore worked on a member edit, a deleted announcement and team rename/remove-with-move (members moved back).
• Uploaded photos load for that chapter's sessions and return 404 for the other chapter.
• There's no sideways scrolling at 390px or 1280px. Lint and build pass.

Deploy notes

• No new environment variables. Announcement emails use the existing BREVO_API_KEY and BOARD_INVITE_FROM, and BOARD_INVITE_FROM's domain must be verified in Brevo.
• The new tables and columns are created automatically on first load, like before.
• UCLA's submission routing to Rizwaan matches the team names "App Dev" and "Data" in lib/board/chapter-server.ts. Renaming those teams on the hub needs a matching code change (noted in BOARD_SETUP.md).

---

Generated by Claude Code