feat(wall): keep the admin unlock until explicitly locked

The admin token lived in sessionStorage, so closing the tab silently
relocked admin mode and the maintainer had to re-enter the token every
session. Store it in localStorage instead: the unlock now survives
reloads, closed tabs and restarts until lockAdmin() clears it. The
Worker remains the sole authority validating the token on every
request; a bonus is the cross-tab `storage` listener in useWallAdmin
now actually fires.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Caldis

website/app/hooks/useWallAdmin.ts

@@ -8,15 +8,15 @@ import {
   verifyAdmin,
 } from "@/app/services/wall";
 
-// Shared admin (panel moderation) state for the wall. sessionStorage is the source
+// Shared admin (panel moderation) state for the wall. localStorage is the source
 // of truth (written in services/wall.ts); this hook mirrors it into React and
 // keeps the sibling WallHeader (which unlocks) and WallClient (which shows the
 // delete affordances) in sync via a window event. Lighter than a Context
 // provider — which page.tsx can't host, being a server component that owns the
 // static `metadata` required by the static export.
 export function useWallAdmin() {
   // Start false on both server and first client render to avoid an SSR/hydration
-  // mismatch; the real value is read from sessionStorage after mount.
+  // mismatch; the real value is read from localStorage after mount.
   const [admin, setAdmin] = useState(false);
 
   useEffect(() => {

website/app/services/wall.ts

@@ -227,19 +227,20 @@ export function getOwner(): string {
 
 // --- Admin (panel moderation) -----------------------------------------------
 // A single shared secret unlocks panel moderation (delete ANY note). It lives in
-// sessionStorage — cleared when the tab closes, safer than localStorage for a
-// privileged credential — and rides on the x-wall-admin header. The Worker is the
-// only authority: without a valid token every admin request is rejected, so the
-// client-side "admin mode" is purely a UI affordance, not a security boundary.
+// localStorage — the maintainer asked for a non-expiring unlock, so it survives
+// reloads, closed tabs and restarts until explicitly locked — and rides on the
+// x-wall-admin header. The Worker is the only authority: without a valid token
+// every admin request is rejected, so the client-side "admin mode" is purely a
+// UI affordance, not a security boundary.
 const ADMIN_TOKEN_KEY = "wall_admin";
 // Same-tab listeners can't use the native `storage` event (it only fires in OTHER
 // tabs), so unlock/lock dispatch this so the current tab's hook re-renders too.
 export const WALL_ADMIN_EVENT = "wall-admin-change";
 
 export function getAdminToken(): string {
-  if (typeof sessionStorage === "undefined") return "";
+  if (typeof localStorage === "undefined") return "";
   try {
-    return sessionStorage.getItem(ADMIN_TOKEN_KEY) ?? "";
+    return localStorage.getItem(ADMIN_TOKEN_KEY) ?? "";
   } catch {
     return "";
   }
@@ -251,8 +252,8 @@ export function isAdminUnlocked(): boolean {
 
 function setAdminToken(token: string): void {
   try {
-    if (token) sessionStorage.setItem(ADMIN_TOKEN_KEY, token);
-    else sessionStorage.removeItem(ADMIN_TOKEN_KEY);
+    if (token) localStorage.setItem(ADMIN_TOKEN_KEY, token);
+    else localStorage.removeItem(ADMIN_TOKEN_KEY);
   } catch {
     // private mode / quota — admin mode just won't persist; ignore.
   }