[Blog] Admin-gated CRUD routes for /news

[gregv]

What does the PR do?

Adds admin-gated CRUD routes for the news Firestore collection so the new frontend /admin/blog CMS (opportunity-hack/frontend-ohack.dev#293) can create, edit, publish/unpublish, and delete blog posts. Today the only write path is POST /api/messages/news with X-Api-Key (the Slack integration); that path is not touched so the Slack flow keeps working.

New routes (all under /api/messages/admin/news, gated with volunteer.admin)

• GET /admin/news?limit=&status= — admin list, includes drafts and archived posts
• POST /admin/news — create (default status="draft", skips OpenAI image-gen when featured_image is supplied)
• PATCH /admin/news/<id> — partial update (allowlisted fields only, clears get_news cache)
• DELETE /admin/news/<id> — hard delete

Service / firebase changes

• services/news_service.py adds admin_create_news, admin_update_news, admin_delete_news, admin_list_news. The allowlist _ADMIN_ALLOWED_KEYS is the only way new fields get through PATCH. New helper _is_publicly_visible filters status in ("draft", "archived") out of the public get_news for both list and single-item reads (over-fetches by 3x so the post-filter count still hits the requested limit).
• common/utils/firebase.py adds update_news_partial, delete_news, and get_all_news_admin.

New optional fields on a news doc (legacy docs unchanged)

content_markdown, content_format ("html" | "markdown"), featured_image, author{name,email,propel_user_id,db_id}, tags[], slug, status ("draft" | "published" | "archived"), published_at (ISO), seo{title,description,keywords[],canonical,og_image}, last_updated_by, created_by.

Type of change

• Breaking Change
• Bug Fix
• New Feature

Linked Issue

Frontend companion: opportunity-hack/frontend-ohack.dev#293 — must merge alongside this so the admin UI is functional end-to-end.

Make sure you have

• Pulled from the default branch
• Documented your changes (see the new "Blog Admin" section in frontend-ohack.dev/CLAUDE.md)
• Linked the Issue
• Appointed a reviewer (if any)

Reviewer notes

• The public POST /api/messages/news endpoint (X-Api-Key) is deliberately untouched — the Slack integration depends on it. Only new admin routes are added.
• get_news now drops status=draft|archived from public responses; admins reading via the new /admin/news routes see everything.
• DELETE is hard delete (Firestore doc removed). The frontend confirm dialog spells out the post title to make accidental deletes hard.
• admin_create_news skips OpenAI image generation when featured_image is supplied — saves an API call and lets admins use their own images.
• slack_ts is stamped to time.time() on admin-created posts so existing ordering keeps working without an explicit Slack message.

🤖 Generated with Claude Code