Admin dashboard — topology

How the swisscairn operator dashboard (login heatmap, signup/checkout funnel, custom-key minting) fits together. Tracking issue: #33. Full rationale: Wiki.js ADR-0002 (cairn/adr/0002-admin-dashboard).

Reading the diagram

Browser · operator — account.html and admin.html are served from the same origin (www.swisscairn.ch), so admin.html reuses the session bearer token from sessionStorage; no second login. account.html shows the Admin link only when GET /v1/me reports admin: true.
Caddy — terminates TLS on the VPS and forwards the real client IP (X-Forwarded-For); the app trusts only Caddy.
cairn-license-server — the hub: an allowlist gate on /v1/admin/*; login events resolved to a country via an offline GeoIP DB; the Paddle webhook records the funnel; custom keys minted through the existing issueFor path.
SQLite — the store from ADR-0001; licenses plus a new events table holding only email + resolved country.
Paddle — external; sends transaction.created (checkout opened) and transaction.completed (paid) webhooks that drive the funnel.
VPS · Switzerland — everything inside the boundary is on one Swiss VPS. Analytics data is country-level only, short retention, no backups, and never leaves the box — so it never leaves Switzerland.

The .svg source lives at docs/admin-dashboard-topology.svg in the repo.