Refactor authentication system with tier-based access control

- Replace group-based auth with user/board/admin tier system
- Add direct login functionality alongside OAuth
- Implement role-based middleware for route protection
- Create dashboard pages and admin API endpoints
- Add error handling page and improved user management
- Maintain backward compatibility with legacy role methods

server/api/auth/callback.get.ts

@@ -36,14 +36,24 @@ export default defineEventHandler(async (event) => {
     // Get user info
     const userInfo = await keycloak.getUserInfo(tokens.access_token);
 
+    // Tier determination logic - admin > board > user priority
+    const determineTier = (groups: string[]): 'user' | 'board' | 'admin' => {
+      if (groups.includes('admin')) return 'admin';
+      if (groups.includes('board')) return 'board';
+      return 'user'; // Default tier
+    };
+
     // Create session
     const sessionData = {
       user: {
         id: userInfo.sub,
         email: userInfo.email,
-        name: userInfo.name || `${userInfo.given_name} ${userInfo.family_name}`.trim(),
-        groups: userInfo.groups || [],
-        tier: userInfo.tier,
+        name: userInfo.name || `${userInfo.given_name || ''} ${userInfo.family_name || ''}`.trim(),
+        firstName: userInfo.given_name,
+        lastName: userInfo.family_name,
+        username: userInfo.preferred_username,
+        tier: determineTier(userInfo.groups || []),
+        groups: userInfo.groups || ['user'],
       },
       tokens: {
         accessToken: tokens.access_token,

server/api/auth/direct-login.post.ts

@@ -203,15 +203,24 @@ export default defineEventHandler(async (event) => {
       name: userInfo.name
     });
 
+    // Tier determination logic - admin > board > user priority
+    const determineTier = (groups: string[]): 'user' | 'board' | 'admin' => {
+      if (groups.includes('admin')) return 'admin';
+      if (groups.includes('board')) return 'board';
+      return 'user'; // Default tier
+    };
+
     // Create session data with extended expiry if remember me
     const sessionData = {
       user: {
         id: userInfo.sub,
         email: userInfo.email,
         name: userInfo.name || `${userInfo.given_name || ''} ${userInfo.family_name || ''}`.trim(),
-        groups: userInfo.groups || [],
-        tier: userInfo.tier,
-        username: userInfo.preferred_username || username
+        firstName: userInfo.given_name,
+        lastName: userInfo.family_name,
+        username: userInfo.preferred_username || username,
+        tier: determineTier(userInfo.groups || []),
+        groups: userInfo.groups || ['user']
       },
       tokens: {
         accessToken: tokens.access_token,