feat(admin): allow anaconda platform admins

[pandemicsyn]

Summary

• Expand platform-admin eligibility to include exact @anaconda.com email and anaconda.com hosted-domain pairs, alongside the existing Kilo Code pair.
• Use the shared allowlist in both candidate search and direct grant authorization so visible candidates and server-enforced eligibility remain aligned.
• Update grant panel copy and regression coverage for the new eligible domain and rejected lookalikes.

Verification

• Manual verification was not run; exercising this flow requires an authenticated superadmin and eligible database-backed user account.
• Additional manual verification:

Visual Changes

Before	After
Grant panel describes only kilocode.ai users as eligible.	Grant panel describes both kilocode.ai and anaconda.com users as eligible.

Reviewer Notes

• Eligibility remains case-sensitive and requires the email suffix and stored hosted domain to match the same allowed domain exactly; subdomains, lookalikes, and mixed-domain pairs remain ineligible.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of new commit f8e3264 (an empty CI-retrigger commit) found no code changes since the prior review at 920d03e; the anaconda.com platform-admin eligibility broadening remains consistent and safe as previously assessed — the same per-domain email+hosted-domain pair rule gates both candidate search and setPlatformAdminAccess, with regression tests covering cross-domain, uppercase, subdomain, and lookalike rejections.

Files Reviewed (5 files)

• apps/web/src/lib/admin/platform-admin.ts
• apps/web/src/lib/admin/platform-admin.test.ts
• apps/web/src/routers/admin-router.ts
• apps/web/src/routers/admin-platform-admins.test.ts
• apps/web/src/app/admin/components/PlatformAdminsContent.tsx

Previous Review Summary (commit 920d03e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 920d03e)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Eligibility broadening to anaconda.com is implemented consistently and safely: the same per-domain email+hosted-domain pair rule gates candidate search (like, case-sensitive, matching isEligibleForPlatformAdmin), and setPlatformAdminAccess independently re-validates against freshly locked rows, so search and grant cannot disagree. Cross-domain mismatches, uppercase, subdomain, and registrable-lookalike variants are all covered by new regression tests.

Advisory note (non-blocking, no inline comment)

Users who sign in via the Anaconda OAuth provider are stored with the placeholder hosted_domain = '@@anaconda@@' (hosted_domain_specials.anaconda, see createAnacondaAccountInfo in apps/web/src/lib/user/server.ts), so this PR's 'anaconda.com' literal will only match Anaconda users who authenticated via Google Workspace, WorkOS SSO, or email auth with a verified @anaconda.com address — not the @@anaconda@@ provider population. This matches the PR description's stated intent ("exact @anaconda.com email and hosted-domain pairs"), so it is not flagged as a defect; if the goal was also to cover Anaconda-OAuth-provider accounts, a follow-up would be needed.

Files Reviewed (5 files)

• apps/web/src/lib/admin/platform-admin.ts
• apps/web/src/lib/admin/platform-admin.test.ts
• apps/web/src/routers/admin-router.ts
• apps/web/src/routers/admin-platform-admins.test.ts
• apps/web/src/app/admin/components/PlatformAdminsContent.tsx

Custom instruction checks

• Markdown/image-format rule: N/A — no .md files changed.
• Memory-leak watch: no leaks introduced — changes are a static constant array, a pure predicate, and a query builder; no timers, subscriptions, listeners, or caches added.
• kilocode-landing content/SEO rules: N/A — this is the cloud repo, no landing/content pages changed.

---

_{Reviewed by kimi-k3 · Input: 28.5K · Output: 3.4K · Cached: 146.4K}

_{Review guidance: REVIEW.md from base branch main}