Brand Palette Admin View & iframe Auth Fixes 🎨

Another solid session wrapping up some admin features and squashing auth bugs!

What Got Done

Added a new Brand Palette view to the dashboard - admin/owner eyes only. Created the full frontend setup with brand-palette.html and brand-palette-view.js, complete with admin guards and proper iframe embedding. Wired it into the nav sidebar and routing.

The bigger win was finally fixing those annoying iframe auth issues that were plaguing the Task Board and Lessons pages. The problem was inconsistent token reading patterns and a nasty redirect bug that would nest the dashboard inside itself.

The Auth Fix

Switched all standalone pages to read from sessionStorage first, then fall back to localStorage - keeping it consistent with the main state.js pattern. The key insight was changing iframe auth failures to use postMessage up to the parent instead of self-redirecting. No more double-nav nightmare!

Admin Gating

The Brand Palette has a nice two-layer security approach - CSS class hides the nav item for non-admins, plus a guard in setActiveView() that bounces you back to the board if you try to access it directly. Simple but effective.

Clean Slate

Also took time to review and commit all those unstaged files that had been sitting around from previous sessions. The repo is squeaky clean now with everything pushed to main and Vercel auto-deploy triggered.

Next up: verifying the Brand Palette actually renders correctly in production for admin users. But that's a problem for future me!