feat: Enable sorting of workbook order in Kanban board (#943)

.claude/rules/auth.md

@@ -1,8 +1,10 @@
 ---
 description: Authentication rules
-globs:
+paths:
   - 'src/lib/server/auth.ts'
   - 'src/routes/(auth)/**'
+  - 'src/routes/(admin)/_utils/auth.ts'
+  - 'src/routes/(admin)/**'
   - 'src/hooks.server.ts'
 ---
 
@@ -30,6 +32,9 @@ globs:
 
 - `src/lib/server/auth.ts`: Lucia configuration
 - `src/hooks.server.ts`: Global request handler
+- `src/routes/(admin)/_utils/auth.ts`:
+  - `validateAdminAccess(locals)` — for page routes; redirects to `/login` for both unauthenticated and non-admin users (do not use in `+server.ts`)
+  - `validateAdminAccessForApi(locals)` — for API routes (`+server.ts`); throws `error(401)` if unauthenticated, `error(403)` if not admin
 - `prisma/schema.prisma`: User, Session, Key models
 
 ## Security

.claude/rules/coding-style.md

@@ -0,0 +1,48 @@
+# Coding Style
+
+## Naming
+
+- **Abbreviations**: avoid non-standard abbreviations (`res` → `response`, `btn` → `button`). When in doubt, spell it out.
+- **Lambda parameters**: no single-character names (e.g., use `placement`, `workbook`). Iterator index `i` is the only exception.
+- **`upsert`**: only use when the implementation performs both insert and update. For insert-only, use `initialize`, `seed`, or another accurate verb.
+- **`any`**: before using `any`, check the value's origin — adding a missing `@types/*` or `devDependency` often provides the correct type.
+- **UI labels**: if a label does not match actual behavior, update it or add an inline comment explaining the intentional mismatch.
+
+## Syntax
+
+- **Braces**: always use braces for single-statement `if` blocks. Never `if () return;` — write `if () { return; }`.
+- **Plural type aliases**: define `type Placements = Placement[]` instead of using `Placement[]` directly in signatures and variables.
+
+## Markdown Code Blocks
+
+Always specify a language identifier on every fenced code block. Never write bare ` ``` `.
+
+Common identifiers: `typescript`, `svelte`, `sql`, `bash`, `mermaid`, `json`, `prisma`, `html`, `css`.
+
+## SvelteKit: Routes vs API Endpoints
+
+- Page routes (`+page.server.ts`): use `redirect()` to navigate
+- API routes (`+server.ts`): use `error()` — throwing `redirect()` returns a 3xx response; `fetch` follows it by default and receives the HTML page at the redirect target instead of a JSON error
+
+## Dual-Enforcement Constraints
+
+When the same constraint is enforced in two layers (e.g. Zod validation + SQL `CHECK`), add an inline comment stating each layer's role and the obligation to keep them in sync:
+
+```typescript
+// XOR constraint: dual enforcement via Zod (early validation) and a CHECK in migration.sql (last line of defence).
+// Prisma lacks @@check, so the SQL constraint is maintained manually. Keep both in sync.
+.refine(...)
+```
+
+## Async Rollback: Capture State Before `await`
+
+Capture `$state` values before the first `await` for safe rollback. A concurrent update can overwrite the variable while awaiting:
+
+```typescript
+const previous = items; // capture before await
+try {
+  await saveToServer(items);
+} catch {
+  items = previous;
+}
+```

.claude/rules/prisma-db.md

@@ -1,40 +1,69 @@
 ---
 description: Prisma and database rules
-globs:
+paths:
   - 'prisma/**'
   - 'src/lib/server/**'
   - 'src/lib/services/**'
+  - 'src/features/**/services/**'
 ---
 
 # Prisma & Database
 
 ## Schema Changes
 
 1. Edit `prisma/schema.prisma`
-2. Run `pnpm exec prisma migrate dev --name <description>` to create migration
-3. Run `pnpm exec prisma generate` to update client (auto-runs after migrate)
+2. Run `pnpm exec prisma migrate dev --name <snake_case_description>`
 
 ## Naming
 
-- Model names: `PascalCase` (e.g., `User`, `TaskAnswer`)
-- Field names: `camelCase` (preferred) or `snake_case` (legacy)
-- Relation fields: Descriptive names matching the relation
-
-## Key Models
-
-- `User`: User accounts with AtCoder validation status
-- `Task`: Tasks with difficulty grades (Q11-D6)
-- `TaskAnswer`: User submission status per task
-- `WorkBook`: task collections
-- `Tag` / `TaskTag`: task categorization
+- Models: `PascalCase` | Fields: `camelCase` (preferred) or `snake_case` (legacy)
 
 ## Server-Only Code
 
-- Import database client only in `src/lib/server/`
-- Use `$lib/server/database` for Prisma client access
+- Import DB client only in `src/lib/server/` via `$lib/server/database`
 - Never import server code in client components
 
+## Service Layer
+
+- All CRUD through the service layer (`src/lib/services/` or `src/features/**/services/`)
+- Route handlers call service methods — no direct Prisma in `+server.ts` / `+page.server.ts`
+- Service functions return pure values (`{ error: string } | null`), never `Response` / `json()`
+
 ## Transactions
 
-- Use `prisma.$transaction()` for multi-step operations
-- Handle errors with try-catch and proper rollback
+Use `prisma.$transaction()` for multi-step operations.
+
+## N+1 Queries
+
+Replace per-item DB calls in loops with a bulk fetch + `Map`:
+
+```typescript
+const records = await prisma.foo.findMany({ where: { id: { in: ids } } });
+const map = new Map(records.map((r) => [r.id, r]));
+```
+
+## Enum Types
+
+Prisma-generated enums and app-defined enums are distinct TypeScript types even with identical members. Keep explicit casts at the boundary — do not remove them as "redundant".
+
+## Idempotent Writes
+
+Prefer `createMany({ skipDuplicates: true })` over catching P2002 for expected unique violations (e.g., double-submit). Maps to `INSERT ... ON CONFLICT DO NOTHING`. Top-level only (not nested); PostgreSQL/CockroachDB/SQLite only.
+
+## Zod Schema for Int Fields
+
+`z.number().positive()` passes decimals. For Prisma `Int` fields use `z.number().int().positive()`.
+
+## Validate Constraints
+
+Prisma does not support `@@check`. To add one:
+
+1. `pnpm exec prisma migrate dev --create-only --name <description>` — generate migration without applying
+2. Edit the generated `migration.sql` to add the CHECK constraint manually
+3. `pnpm exec prisma migrate dev` — apply
+
+Document the constraint in `prisma/ERD.md` (the only place it's visible):
+
+```mermaid
+%% XOR constraint: workbookplacement_xor_grade_category — exactly one of taskGrade or solutionCategory must be non-null
+```

.claude/rules/svelte-components.md

@@ -1,6 +1,6 @@
 ---
 description: Svelte component development rules
-globs:
+paths:
   - 'src/**/*.svelte'
   - 'src/lib/components/**'
   - 'src/lib/stores/**/*.svelte.ts'
@@ -10,37 +10,96 @@ globs:
 
 ## Runes Mode (Required)
 
-- Use `$props()` for component props
-- Use `$state()` for reactive state
-- Use `$derived()` for computed values
-- Use `$effect()` for side effects
-
-## Props Pattern
+Use `$props()`, `$state()`, `$derived()`, `$effect()` in all components. Props pattern:
 
 ```svelte
 <script lang="ts">
   interface Props {
     title: string;
     count?: number;
   }
-
   let { title, count = 0 }: Props = $props();
 </script>
 ```
 
-## Stores
+## File Naming
 
-- Place store files in `src/lib/stores/` with `.svelte.ts` extension
-- Use class-based stores with `$state()` for internal state
-- Export singleton instances
+- Components: `PascalCase.svelte`
+- Stores: `snake_case.svelte.ts` in `src/lib/stores/`, class-based with `$state()`, export singleton. Pre-Runes stores (using `writable()`, `.ts` extension) must be migrated to this pattern before adding features or extending them.
 
 ## Flowbite Svelte
 
-- Import components from `flowbite-svelte`
-- Use Tailwind CSS v4 utility classes
-- Dark mode: Use `dark:` prefix for dark mode variants
+Import from `flowbite-svelte`. Use Tailwind CSS v4 utility classes. Dark mode: `dark:` prefix.
 
-## File Naming
+## `$state()` Initialization with `$props()`
 
-- Components: `PascalCase.svelte`
-- Stores: `snake_case.svelte.ts`
+Referencing `$props()` inside `$state()` initializer triggers "This reference only captures the initial value". Wrap with `untrack` if intentional:
+
+```svelte
+let count = $state(untrack(() => initialCount)); // intentional: prop is initial seed only
+```
+
+## `{#snippet}` Placement
+
+Define snippets at the **top level**, outside component tags. Inside a tag = named slot = type error:
+
+```svelte
+<!-- Good -->
+{#snippet footer()}...{/snippet}
+<Dialog {footer} />
+
+<!-- Bad: named slot, not a snippet prop -->
+<Dialog>{#snippet footer()}...{/snippet}</Dialog>
+```
+
+## Snippet vs Component
+
+Prefer `{#snippet}` when: (1) needs direct `$state` access, (2) pure display only, (3) same-file DRY.
+Promote to component when: independent state/lifecycle needed, exceeds ~30 lines, or reused across files.
+
+## Component Boundaries
+
+- One component, one responsibility: don't mix display, state management, and data fetching
+- Extract `$derived`/`$effect` logic exceeding ~5 lines to a custom store
+- Extract repeated UI patterns (2+ uses) to a snippet or component (see Snippet vs Component)
+
+## Keep Components Thin
+
+Business logic and pure utilities belong outside `<script>` blocks — in the nearest `utils/` (or `_utils/` for routes), with adjacent unit tests. See `docs/guides/architecture.md` for layer-specific placement.
+
+## Pure Functions and Side Effect Separation
+
+Extract business logic as pure functions to `utils/` (or `_utils/` for routes); keep side effects in the caller:
+
+```typescript
+// Pure function in _utils/ — testable, no side effects
+export function buildUpdatedUrl(url: URL, activeTab: ActiveTab): URL { ... }
+
+// Side effect stays in the caller
+replaceState(buildUpdatedUrl($page.url, activeTab), {});
+```
+
+## Empty-list Fallback in `{#each}`
+
+Use `{:else}` to render a placeholder when the list is empty — no wrapper conditional needed:
+
+```svelte
+{#each items as item (item.id)}
+  <Card {item} />
+{:else}
+  <p>No items yet.</p>
+{/each}
+```
+
+## Eliminate Branching with Records
+
+Replace `if`/ternary chains with `Record<EnumType, T>`:
+
+```typescript
+const TAB_CONFIGS: Record<ActiveTab, TabConfig> = {
+  curriculum: { label: 'Curriculum', ... },
+  solution:   { label: 'Solution',   ... },
+};
+```
+
+Use the enum type as the key type, not `string`.

.claude/rules/testing.md

@@ -1,6 +1,6 @@
 ---
 description: Testing rules and patterns
-globs:
+paths:
   - '**/*.test.ts'
   - '**/*.spec.ts'
   - 'tests/**'
@@ -9,46 +9,75 @@ globs:
 
 # Testing
 
+## Test Integrity
+
+- Never delete, comment out, or weaken assertions (e.g. `toEqual` → `toBeDefined`) to make tests pass
+- Fix the implementation, not the test; if the test itself is wrong, explain why in a comment or commit message
+
 ## Test Types
 
-| Type        | Tool       | Location                | Run Command             |
-| ----------- | ---------- | ----------------------- | ----------------------- |
-| Unit        | Vitest     | `src/test/**/*.test.ts` | `pnpm test:unit`        |
-| Integration | Vitest     | `src/test/`             | `pnpm test:unit`        |
-| E2E         | Playwright | `tests/*.test.ts`       | `pnpm test:integration` |
+| Type | Tool       | Location                                                          | Run Command             |
+| ---- | ---------- | ----------------------------------------------------------------- | ----------------------- |
+| Unit | Vitest     | `src/test/` (mirrors `src/lib/`) or co-located in `src/features/` | `pnpm test:unit`        |
+| E2E  | Playwright | `tests/`                                                          | `pnpm test:integration` |
+
+## Assertions
+
+- Use `toBe(true)` / `toBe(false)` over `toBeTruthy()` / `toBeFalsy()`
+- For DB query tests, assert `orderBy`, `include`, and other significant parameters with `expect.objectContaining` — not just `where`
+- Enum membership: `in` traverses the prototype chain; use `Object.hasOwn(Enum, value)` instead
 
-## Unit Tests
+## Cleanup in Tests
+
+Wrap DB-mutating cleanup in `try/finally` — a failing assertion skips cleanup and contaminates later tests:
+
+```typescript
+try {
+  await doSomething();
+  expect(result).toBe(expected);
+} finally {
+  await restoreState();
+}
+```
 
-- Place tests in `src/test/` mirroring `src/lib/` structure
-- Use `@quramy/prisma-fabbrica` for test data factories
-- Mock external APIs with Nock
+## Test Data
 
-## E2E Tests
+- Use realistic fixture values (real task IDs, grade names) instead of placeholders like `'t1'`
+- Extract shared data into fixture files; inline is fine for single-use cases
+- After `.filter()` on fixtures, verify actual contents — same ID may refer to a different entity after fixture updates
 
-- Place in `tests/` directory
-- Use Playwright test utilities
-- Test user flows, not implementation details
+## Mock Helpers
 
-## Patterns
+Extract repeated mock patterns into a helper in the test file:
 
 ```typescript
-import { describe, test, expect, vi } from 'vitest';
-
-describe('functionName', () => {
-  test('expects to do something', () => {
-    // Arrange
-    // Act
-    // Assert
-  });
-});
+function mockFindMany(value: WorkBookPlacements) {
+  vi.mocked(prisma.workBookPlacement.findMany).mockResolvedValue(
+    value as unknown as Awaited<ReturnType<typeof prisma.workBookPlacement.findMany>>,
+  );
+}
 ```
 
+## Testing Extracted Utilities
+
+- Add tests at extraction time, not later
+- For URL manipulation: assert the original URL is not mutated
+- For multi-column operations (e.g., DnD): assert both source and destination columns
+
 ## Coverage
 
 - Run `pnpm coverage` for coverage report
 - Target: 80% lines, 70% branches
 
+## Service Layer Split for Testability
+
+When a service file mixes DB operations and pure functions, split it into two files:
+
+- `crud.ts` — DB operations (`getXxx`, `updateXxx`, `createXxx`); tests need Prisma mocks
+- `initializers.ts` — pure computation (grade grouping, priority assignment); tests need no mocks
+
+Stop the split if internal helpers (e.g. `fetchUnplacedWorkbooks`) would be fragmented across files — cohesion matters more than the split itself.
+
 ## HTTP Mocking
 
-- Use Nock for mocking external HTTP calls
-- See `src/test/lib/clients/` for examples
+Use Nock for external HTTP calls. See `src/test/lib/clients/` for examples.