feat: Enable sorting of workbook order in Kanban board (#943)

.claude/rules/auth.md

@@ -1,8 +1,10 @@
 ---
 description: Authentication rules
-globs:
+paths:
   - 'src/lib/server/auth.ts'
   - 'src/routes/(auth)/**'
+  - 'src/routes/(admin)/_utils/auth.ts'
+  - 'src/routes/(admin)/**'
   - 'src/hooks.server.ts'
 ---
 
@@ -30,6 +32,9 @@ globs:
 
 - `src/lib/server/auth.ts`: Lucia configuration
 - `src/hooks.server.ts`: Global request handler
+- `src/routes/(admin)/_utils/auth.ts`:
+  - `validateAdminAccess(locals)` — for page routes; redirects to `/login` for both unauthenticated and non-admin users (do not use in `+server.ts`)
+  - `validateAdminAccessForApi(locals)` — for API routes (`+server.ts`); throws `error(401)` if unauthenticated, `error(403)` if not admin
 - `prisma/schema.prisma`: User, Session, Key models
 
 ## Security

.claude/rules/coding-style.md

@@ -0,0 +1,38 @@
+# Coding Style
+
+## Naming
+
+- **Abbreviations**: avoid non-standard abbreviations (`res` → `response`, `btn` → `button`). When in doubt, spell it out.
+- **Lambda parameters**: no single-character names (e.g., use `placement`, `workbook`). Iterator index `i` is the only exception.
+- **`upsert`**: only use when the implementation performs both insert and update. For insert-only, use `initialize`, `seed`, or another accurate verb.
+- **`any`**: before using `any`, check the value's origin — adding a missing `@types/*` or `devDependency` often provides the correct type.
+- **UI labels**: if a label does not match actual behavior, update it or add an inline comment explaining the intentional mismatch.
+
+## Syntax
+
+- **Braces**: always use braces for single-statement `if` blocks. Never `if () return;` — write `if () { return; }`.
+- **Plural type aliases**: define `type Placements = Placement[]` instead of using `Placement[]` directly in signatures and variables.
+
+## Markdown Code Blocks
+
+Always specify a language identifier on every fenced code block. Never write bare ` ``` `.
+
+Common identifiers: `typescript`, `svelte`, `sql`, `bash`, `mermaid`, `json`, `prisma`, `html`, `css`.
+
+## SvelteKit: Routes vs API Endpoints
+
+- Page routes (`+page.server.ts`): use `redirect()` to navigate
+- API routes (`+server.ts`): use `error()` — throwing `redirect()` causes `fetch` clients to receive HTML instead of a JSON error
+
+## Async Rollback: Capture State Before `await`
+
+Capture `$state` values before the first `await` for safe rollback. A concurrent update can overwrite the variable while awaiting:
+
+```typescript
+const previous = items; // capture before await
+try {
+  await saveToServer(items);
+} catch {
+  items = previous;
+}
+```

.claude/rules/prisma-db.md

@@ -1,40 +1,69 @@
 ---
 description: Prisma and database rules
-globs:
+paths:
   - 'prisma/**'
   - 'src/lib/server/**'
   - 'src/lib/services/**'
+  - 'src/features/**/services/**'
 ---
 
 # Prisma & Database
 
 ## Schema Changes
 
 1. Edit `prisma/schema.prisma`
-2. Run `pnpm exec prisma migrate dev --name <description>` to create migration
-3. Run `pnpm exec prisma generate` to update client (auto-runs after migrate)
+2. Run `pnpm exec prisma migrate dev --name <snake_case_description>`
 
 ## Naming
 
-- Model names: `PascalCase` (e.g., `User`, `TaskAnswer`)
-- Field names: `camelCase` (preferred) or `snake_case` (legacy)
-- Relation fields: Descriptive names matching the relation
-
-## Key Models
-
-- `User`: User accounts with AtCoder validation status
-- `Task`: Tasks with difficulty grades (Q11-D6)
-- `TaskAnswer`: User submission status per task
-- `WorkBook`: task collections
-- `Tag` / `TaskTag`: task categorization
+- Models: `PascalCase` | Fields: `camelCase` (preferred) or `snake_case` (legacy)
 
 ## Server-Only Code
 
-- Import database client only in `src/lib/server/`
-- Use `$lib/server/database` for Prisma client access
+- Import DB client only in `src/lib/server/` via `$lib/server/database`
 - Never import server code in client components
 
+## Service Layer
+
+- All CRUD through the service layer (`src/lib/services/` or `src/features/**/services/`)
+- Route handlers call service methods — no direct Prisma in `+server.ts` / `+page.server.ts`
+- Service functions return pure values (`{ error: string } | null`), never `Response` / `json()`
+
 ## Transactions
 
-- Use `prisma.$transaction()` for multi-step operations
-- Handle errors with try-catch and proper rollback
+Use `prisma.$transaction()` for multi-step operations.
+
+## N+1 Queries
+
+Replace per-item DB calls in loops with a bulk fetch + `Map`:
+
+```typescript
+const records = await prisma.foo.findMany({ where: { id: { in: ids } } });
+const map = new Map(records.map((r) => [r.id, r]));
+```
+
+## Enum Types
+
+Prisma-generated enums and app-defined enums are distinct TypeScript types even with identical members. Keep explicit casts at the boundary — do not remove them as "redundant".
+
+## Idempotent Writes
+
+Prefer `createMany({ skipDuplicates: true })` over catching P2002 for expected unique violations (e.g., double-submit). Maps to `INSERT ... ON CONFLICT DO NOTHING`. Top-level only (not nested); PostgreSQL/CockroachDB/SQLite only.
+
+## Zod Schema for Int Fields
+
+`z.number().positive()` passes decimals. For Prisma `Int` fields use `z.number().int().positive()`.
+
+## Validate Constraints
+
+Prisma does not support `@@check`. To add one:
+
+1. `pnpm exec prisma migrate dev --create-only --name <description>` — generate migration without applying
+2. Edit the generated `migration.sql` to add the CHECK constraint manually
+3. `pnpm exec prisma migrate dev` — apply
+
+Document the constraint in `prisma/ERD.md` (the only place it's visible):
+
+```mermaid
+%% XOR constraint: workbookplacement_xor_grade_category — exactly one of taskGrade or solutionCategory must be non-null
+```

.claude/rules/svelte-components.md

@@ -1,6 +1,6 @@
 ---
 description: Svelte component development rules
-globs:
+paths:
   - 'src/**/*.svelte'
   - 'src/lib/components/**'
   - 'src/lib/stores/**/*.svelte.ts'
@@ -10,37 +10,82 @@ globs:
 
 ## Runes Mode (Required)
 
-- Use `$props()` for component props
-- Use `$state()` for reactive state
-- Use `$derived()` for computed values
-- Use `$effect()` for side effects
-
-## Props Pattern
+Use `$props()`, `$state()`, `$derived()`, `$effect()` in all components. Props pattern:
 
 ```svelte
 <script lang="ts">
   interface Props {
     title: string;
     count?: number;
   }
-
   let { title, count = 0 }: Props = $props();
 </script>
 ```
 
-## Stores
+## File Naming
 
-- Place store files in `src/lib/stores/` with `.svelte.ts` extension
-- Use class-based stores with `$state()` for internal state
-- Export singleton instances
+- Components: `PascalCase.svelte`
+- Stores: `snake_case.svelte.ts` in `src/lib/stores/`, class-based with `$state()`, export singleton
 
 ## Flowbite Svelte
 
-- Import components from `flowbite-svelte`
-- Use Tailwind CSS v4 utility classes
-- Dark mode: Use `dark:` prefix for dark mode variants
+Import from `flowbite-svelte`. Use Tailwind CSS v4 utility classes. Dark mode: `dark:` prefix.
 
-## File Naming
+## `$state()` Initialization with `$props()`
 
-- Components: `PascalCase.svelte`
-- Stores: `snake_case.svelte.ts`
+Referencing `$props()` inside `$state()` initializer triggers "This reference only captures the initial value". Wrap with `untrack` if intentional:
+
+```svelte
+let count = $state(untrack(() => initialCount)); // intentional: prop is initial seed only
+```
+
+## `{#snippet}` Placement
+
+Define snippets at the **top level**, outside component tags. Inside a tag = named slot = type error:
+
+```svelte
+<!-- Good -->
+{#snippet footer()}...{/snippet}
+<Dialog {footer} />
+
+<!-- Bad: named slot, not a snippet prop -->
+<Dialog>{#snippet footer()}...{/snippet}</Dialog>
+```
+
+## Snippet vs Component
+
+Prefer `{#snippet}` when: (1) needs direct `$state` access, (2) pure display only, (3) same-file DRY.
+Promote to component when: independent state/lifecycle needed, exceeds ~30 lines, or reused across files.
+
+## Keep Components Thin
+
+Business logic and pure utilities belong in `_types/` and `_utils/`, not in `<script>` blocks:
+
+- Static config → `_utils/` constants
+- Pure computation → `_utils/` functions with adjacent tests
+
+## Pure Functions and Side Effect Separation
+
+Extract business logic as pure functions to `_utils/`; keep side effects in the caller:
+
+```typescript
+// Before: untestable
+function updateUrl() { replaceState(new URL($page.url).searchParams.set('tab', activeTab)); }
+
+// After: pure function in _utils/, side effect in caller
+export function buildUpdatedUrl(url: URL, activeTab: ActiveTab): URL { ... }
+// Caller: replaceState(buildUpdatedUrl($page.url, activeTab), {})
+```
+
+## Eliminate Branching with Records
+
+Replace `if`/ternary chains with `Record<EnumType, T>`:
+
+```typescript
+const TAB_CONFIGS: Record<ActiveTab, TabConfig> = {
+  curriculum: { label: 'Curriculum', ... },
+  solution:   { label: 'Solution',   ... },
+};
+```
+
+Use the enum type as the key type, not `string`.

.claude/rules/testing.md

@@ -1,6 +1,6 @@
 ---
 description: Testing rules and patterns
-globs:
+paths:
   - '**/*.test.ts'
   - '**/*.spec.ts'
   - 'tests/**'
@@ -11,44 +11,59 @@ globs:
 
 ## Test Types
 
-| Type        | Tool       | Location                | Run Command             |
-| ----------- | ---------- | ----------------------- | ----------------------- |
-| Unit        | Vitest     | `src/test/**/*.test.ts` | `pnpm test:unit`        |
-| Integration | Vitest     | `src/test/`             | `pnpm test:unit`        |
-| E2E         | Playwright | `tests/*.test.ts`       | `pnpm test:integration` |
+| Type | Tool       | Location                                                          | Run Command             |
+| ---- | ---------- | ----------------------------------------------------------------- | ----------------------- |
+| Unit | Vitest     | `src/test/` (mirrors `src/lib/`) or co-located in `src/features/` | `pnpm test:unit`        |
+| E2E  | Playwright | `tests/`                                                          | `pnpm test:integration` |
 
-## Unit Tests
+## Assertions
 
-- Place tests in `src/test/` mirroring `src/lib/` structure
-- Use `@quramy/prisma-fabbrica` for test data factories
-- Mock external APIs with Nock
+- Use `toBe(true)` / `toBe(false)` over `toBeTruthy()` / `toBeFalsy()`
+- For DB query tests, assert `orderBy`, `include`, and other significant parameters with `expect.objectContaining` — not just `where`
+- Enum membership: `in` traverses the prototype chain; use `Object.hasOwn(Enum, value)` instead
 
-## E2E Tests
+## Cleanup in Tests
 
-- Place in `tests/` directory
-- Use Playwright test utilities
-- Test user flows, not implementation details
+Wrap DB-mutating cleanup in `try/finally` — a failing assertion skips cleanup and contaminates later tests:
 
-## Patterns
+```typescript
+try {
+  await doSomething();
+  expect(result).toBe(expected);
+} finally {
+  await restoreState();
+}
+```
+
+## Test Data
+
+- Use realistic fixture values (real task IDs, grade names) instead of placeholders like `'t1'`
+- Extract shared data into fixture files; inline is fine for single-use cases
+- After `.filter()` on fixtures, verify actual contents — same ID may refer to a different entity after fixture updates
+
+## Mock Helpers
+
+Extract repeated mock patterns into a helper in the test file:
 
 ```typescript
-import { describe, test, expect, vi } from 'vitest';
-
-describe('functionName', () => {
-  test('expects to do something', () => {
-    // Arrange
-    // Act
-    // Assert
-  });
-});
+function mockFindMany(value: WorkBookPlacements) {
+  vi.mocked(prisma.workBookPlacement.findMany).mockResolvedValue(
+    value as unknown as Awaited<ReturnType<typeof prisma.workBookPlacement.findMany>>,
+  );
+}
 ```
 
+## Testing Extracted Utilities
+
+- Add tests at extraction time, not later
+- For URL manipulation: assert the original URL is not mutated
+- For multi-column operations (e.g., DnD): assert both source and destination columns
+
 ## Coverage
 
 - Run `pnpm coverage` for coverage report
 - Target: 80% lines, 70% branches
 
 ## HTTP Mocking
 
-- Use Nock for mocking external HTTP calls
-- See `src/test/lib/clients/` for examples
+Use Nock for external HTTP calls. See `src/test/lib/clients/` for examples.

.claude/skills/refactor-plan/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: refactor-plan
+description: Analyze a GitHub issue or file path and produce a phased refactoring plan. Outputs a TODO list only — does not make code changes.
+disable-model-invocation: true
+argument-hint: '[issue-number | file-path]'
+---
+
+Produce a refactoring plan for: $ARGUMENTS
+
+1. **Gather context** — number: `gh issue view $ARGUMENTS --comments` (if `gh` unavailable, fetch the issue via WebFetch); path: read source files under that path
+2. **Investigate** — read relevant source files; apply the checklist in [instructions.md](instructions.md)
+3. **Plan** — group findings into phases (lowest → highest risk); each phase is a `- [ ]` checklist; note inter-phase dependencies
+4. **Stop — output the plan only. Do not implement any changes.**