05/06 Phase 2: updated and added new files

CLAUDE.md

@@ -668,14 +668,19 @@ WantedBy=multi-user.target
 - [x] `README.md` — full deployment runbook (fresh install, migrations, seeding, service management, backup)
 - [ ] Demo account pre-seeded data (deferred — requires Phase 2 tenant creation flow)
 
-### Phase 2 — Admin Portal
-- [ ] System user management (CRUD, force password reset)
-- [ ] Tenant management (create, edit, suspend, cancel, assign plan)
-- [ ] Plan management (create/edit, feature flags, limits)
-- [ ] Billing history (manual invoice entry, per-tenant view)
-- [ ] Tenant settings override (set/lift with before/after audit trail)
-- [ ] Audit log viewer (filter by actor, action, date; export)
-- [ ] Platform analytics dashboard
+### Phase 2 — Admin Portal ✅ COMPLETE
+- [x] System user management (CRUD, force password reset, activate/deactivate)
+- [x] Tenant management (create with owner account + primary location, edit, suspend/cancel/activate, assign plan)
+- [x] Plan management (create/edit, feature flags via checkboxes, max staff/locations, activate/deactivate)
+- [x] Billing history (manual invoice entry per tenant, global list view, per-tenant view)
+- [x] Tenant settings override (set with note, lift individually, history view, before/after audit trail)
+- [x] Audit log viewer (filter by actor/action/target/date, paginated, CSV export)
+- [x] Platform analytics dashboard (MRR, active/trial/churn counts, revenue 30d, trials expiring soon, plan distribution)
+- [x] `app/admin/utils.py` — `@superadmin_required`, `log_admin_action`, `model_to_dict` shared helpers
+- [x] All Phase 2 blueprints registered in `create_admin_app()` factory
+- [x] Admin base template nav links wired to all Phase 2 routes
+- [x] `tests/test_admin_phase2.py` — full test suite for all 7 modules
+- [x] Demo account creation deferred — available via `POST /tenants/new` with `is_demo=1`
 
 ### Phase 3 — Multi-Location & Tenant Core Modules
 - [ ] Location management (CRUD, primary flag, per-location settings)
@@ -947,4 +952,4 @@ All Phase 2+ blueprints are registered as stubs (blueprint object only, no route
 | 24 | Admin login URL | Admin auth blueprint uses `url_prefix=""`. Login page is at `posadmin.ngodanguyen.tech/login`. Root `/` redirects to `/login` (unauthenticated) or `/dashboard` (authenticated). |
 | 25 | JWT blocklist table location | `jwt_blocklist` defined in `platform.py` (not `salon.py`) — it is a platform-level concern shared across all tenants. DB-persisted (not in-memory) to survive Gunicorn worker restarts. |
 | 26 | Template path convention | `template_folder` points to project-root `templates/`. All `render_template()` calls and `{% extends %}` use full paths: `"admin/auth/login.html"`, `"admin/layouts/base.html"`, `"tenant/auth/login.html"`, etc. |
-| 27 | Production domains | Admin portal: `posadmin.ngodanguyen.tech`. Tenant portal: `pos.ngodanguyen.tech`. Updated in `.env`, `nginx.conf`, and all documentation. |
+| 27 | Production domains | Admin portal: `posadmin.ngodanguyen.tech`. Tenant portal: `pos.ngodanguyen.tech`. Updated in `.env`, `nginx.conf`, and all documentation. |