- Wrap /runs/new and /genlockes/new with ProtectedRoute (requires login) - Create AdminRoute component that checks isAdmin, redirects non-admins with a toast notification - Wrap all /admin/* routes with AdminRoute - Deep-linking preserved: unauthenticated users redirect to login, then back to the original protected route after auth Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>