feat(rcon): add admin server console

design/index.md

@@ -34,6 +34,8 @@ This OKF bundle is the product record for implemented and proposed behavior. Sto
 * [US-018 — Monitor community account activity](us-018-admin-dashboard.md) - Administrators review daily users, confirmed connections, locations, denials, and risky networks.
 * [US-019 — Manage groups efficiently](us-019-admin-group-management.md) - Administrators manage group identity, policies, membership, and creation through focused confirmed workflows.
 * [US-020 — Schedule group access in UTC](us-020-scheduled-group-access.md) - Enabled groups may be restricted to recurring weekly UTC windows with static denial-message templates.
+* [US-021 — Manage RCON server connections](us-021-rcon-connections.md) - Administrators manage encrypted internal Minecraft RCON endpoints.
+* [US-022 — Operate servers through an RCON console](us-022-rcon-console.md) - Administrators execute bounded commands through the server-side portal proxy.
 
 # Tracking
 

design/log.md

@@ -1,5 +1,10 @@
 # Design Update Log
 
+## 2026-08-08
+
+* **Verify**: Added encrypted, allowlisted administrator RCON connection management with credential-safe audits and a generated Drizzle migration.
+* **Implement**: Added a bounded server-side RCON command console with safe output and error handling; internal-only deployment verification remains pending.
+
 ## 2026-08-07
 
 * **Extend**: Show each grouped recent address's latest approximate location and network classification on administrator user records.

design/us-021-rcon-connections.md

@@ -0,0 +1,39 @@
+---
+type: User Story
+title: Manage RCON server connections
+description: Administrators manage encrypted connection settings for internal Minecraft RCON endpoints.
+tags: [admin, rcon, minecraft, security, operations]
+timestamp: 2026-08-08T01:36:00Z
+story_id: US-021
+status: verified
+---
+
+# User Story
+
+As an administrator, I want to manage one or more Minecraft RCON connections, so that server operations can be reached from the existing protected console.
+
+# Acceptance Criteria
+
+- [x] Existing account-manager administrators can list, add, edit, test, enable or disable, and delete RCON server connections.
+- [x] Each connection has a unique display name, internal hostname, port, enabled state, and write-only password.
+- [x] RCON passwords are encrypted with an authenticated cipher using a deployment-managed master key and are never returned to the browser, audit events, or application logs.
+- [x] Updating a connection preserves its password unless an administrator explicitly supplies a replacement.
+- [x] Connection host and port pairs must match a deployment-managed exact internal endpoint allowlist, and IP literals are rejected.
+- [x] Testing a connection authenticates through the server-side RCON proxy and reports a safe success or failure result.
+- [x] Deleting a connection requires explicit confirmation.
+- [x] Connection mutations independently recheck administrator authorization and create credential-safe audit events.
+- [x] Database changes use a generated versioned Drizzle migration rather than schema push.
+
+# Implementation
+
+The administrator RCON page and server actions manage allowlisted endpoints, preserve write-only passwords, encrypt credentials with connection-bound AES-256-GCM, and emit credential-safe audit events. The `rcon_servers` table is delivered through generated migration `0006_curious_lester.sql`.
+
+# Validation
+
+Verified with RCON validation, encryption, gateway, component, and server-action tests; full workspace tests and type checks; web lint; OKF validation; and a production Next.js build on 2026-08-08. Action tests confirm independent authorization, password preservation, enabled-state rechecks, safe failures, and command audit redaction.
+
+# Related Stories
+
+- [Operate servers through an RCON console](us-022-rcon-console.md)
+- [Authenticate administrators with SSO](us-011-admin-sso.md)
+- [Deploy and operate securely](us-015-platform-operations.md)

design/us-022-rcon-console.md

@@ -0,0 +1,39 @@
+---
+type: User Story
+title: Operate servers through an RCON console
+description: Administrators execute bounded RCON commands through the server-side portal proxy.
+tags: [admin, rcon, minecraft, console, security]
+timestamp: 2026-08-08T01:36:00Z
+story_id: US-022
+status: in-progress
+---
+
+# User Story
+
+As an administrator, I want an RCON console in the portal, so that I can operate internal Minecraft servers without exposing RCON publicly.
+
+# Acceptance Criteria
+
+- [x] Existing account-manager administrators can select an enabled connection and execute an RCON command from the admin UI.
+- [x] Browsers never connect to RCON directly; commands pass through the authenticated Next.js server runtime to an internal endpoint.
+- [x] Every command independently rechecks administrator authorization and the selected connection's enabled state.
+- [x] Commands are length-limited, reject control characters, execute with bounded concurrency and a timeout, and return bounded output.
+- [x] Command responses are displayed safely and are not persisted in console history, audit data, or application logs.
+- [x] Audit events record the administrator, connection, command verb and digest, success, and duration without recording complete commands or responses.
+- [x] Authentication, timeout, and connection failures return safe operator-facing messages without credentials or stack traces.
+- [x] The console is keyboard accessible and clearly identifies the selected server.
+- [ ] RCON remains internal to the cluster and is not exposed through public ingress or a load balancer.
+
+# Implementation
+
+The client console invokes an authenticated server action that revalidates the enabled allowlisted connection, decrypts its credential only in the server runtime, and executes one bounded command. The gateway limits each process to one operation per server and eight total operations, applies a five-second end-to-end deadline plus bounded cleanup, sanitizes and truncates output, and records keyed command lifecycle audits without command or response content.
+
+# Validation
+
+Application behavior is verified with gateway, validation, component, credential, and server-action tests; full workspace tests and type checks; web lint; OKF validation; and a production Next.js build on 2026-08-08. Deployment-level verification remains pending because this repository has no Minecraft Kubernetes Service, NetworkPolicy, ingress, or load-balancer manifests with which to prove that the RCON port is internal-only.
+
+# Related Stories
+
+- [Manage RCON server connections](us-021-rcon-connections.md)
+- [Operate settings and audit views](us-012-admin-operations.md)
+- [Preserve an audit trail](us-010-audit-events.md)