refactor: align codebase with EventCrew domain and trim legacy band stack

- Update API: events, users, policies, routes, resources, migrations
- Remove deprecated models/resources (customers, setlists, invitations, etc.)
- Refresh admin app and docs; remove apps/band

Made-with: Cursor

apps/admin/src/lib/api-client.ts

@@ -1,24 +1,36 @@
 import axios from 'axios'
+import { parse } from 'cookie-es'
 import type { AxiosInstance, InternalAxiosRequestConfig } from 'axios'
 
+/**
+ * Single axios instance for the real Laravel API (VITE_API_URL).
+ * Auth: Bearer token from cookie 'accessToken' (set by login).
+ * Use this for all event-crew API calls; useApi (composables/useApi) stays for Vuexy demo/mock endpoints.
+ */
 const apiClient: AxiosInstance = axios.create({
   baseURL: import.meta.env.VITE_API_URL,
   headers: {
     'Content-Type': 'application/json',
-    'Accept': 'application/json',
+    Accept: 'application/json',
   },
   timeout: 30000,
 })
 
-// Request interceptor - add auth token
+function getAccessToken(): string | null {
+  if (typeof document === 'undefined') return null
+  const cookies = parse(document.cookie)
+  const token = cookies.accessToken
+
+  return token ?? null
+}
+
 apiClient.interceptors.request.use(
   (config: InternalAxiosRequestConfig) => {
-    const token = localStorage.getItem('auth_token')
+    const token = getAccessToken()
     if (token) {
       config.headers.Authorization = `Bearer ${token}`
     }
 
-    // Log in development
     if (import.meta.env.DEV) {
       console.log(`🚀 ${config.method?.toUpperCase()} ${config.url}`, config.data)
     }
@@ -28,7 +40,6 @@ apiClient.interceptors.request.use(
   error => Promise.reject(error),
 )
 
-// Response interceptor - handle errors
 apiClient.interceptors.response.use(
   response => {
     if (import.meta.env.DEV) {
@@ -39,13 +50,20 @@ apiClient.interceptors.response.use(
   },
   error => {
     if (import.meta.env.DEV) {
-      console.error(`❌ ${error.response?.status} ${error.config?.url}`, error.response?.data)
+      console.error(
+        `❌ ${error.response?.status} ${error.config?.url}`,
+        error.response?.data,
+      )
     }
 
-    // Handle 401 - redirect to login
     if (error.response?.status === 401) {
-      localStorage.removeItem('auth_token')
-      window.location.href = '/login'
+      // Clear auth cookies (align with utils/api.ts / login flow)
+      document.cookie = 'accessToken=; path=/; max-age=0'
+      document.cookie = 'userData=; path=/; max-age=0'
+      document.cookie = 'userAbilityRules=; path=/; max-age=0'
+      if (window.location.pathname !== '/login') {
+        window.location.href = '/login'
+      }
     }
 
     return Promise.reject(error)
@@ -53,4 +71,3 @@ apiClient.interceptors.response.use(
 )
 
 export { apiClient }
-