Add admin-only CPU tables with per-hand reviews

A new table type, "review" (レビュー付きCPU戦), can only be created by
admins. Only the creator and CPUs sit there: friends cannot join, and the
table is hidden from non-admin lobbies. After every hand a review opens,
and the next hand waits until the creator presses "次のハンドへ".

- Preflop: shows which color of the registered hand range the hole cards
  are and whether the action followed it. With no entrant before you,
  open with the color for the number of players still to act; facing an
  entrant, estimate their range from their position, call one color
  above it and raise two above. Purple ranks just below white (SB only).
- Flop onward: equity vs ranges estimated from those colors (narrowed by
  later bets/calls) gives a rough EV per option. The score is the EV lost
  against the best option, relative to the pot. It is a guide, not GTO.
- Also: pot-odds call check, all-in equity and luck-adjusted P&L,
  VPIP/PFR/3bet/Cbet/WTSD/W$SD/AF, per-color and per-position compliance,
  habits to watch, worst-5 hands, a P&L chart and a step-by-step replay
  on the admin-only /review page.

Hand now logs every action for the review. The range data moves to
admin/range-data.js, shared by the range page and the server. Reviews are
saved under data/reviews/ (newest 50 sessions). Admin scripts and CSS are
no longer cached for a day, so updates show up immediately.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/index.js

@@ -7,6 +7,8 @@ const { Server } = require('socket.io');
 const config = require('./config');
 const auth = require('./auth');
 const { TableManager, MODES } = require('./tables');
+const reviews = require('./review/store');
+const { summarize } = require('./review/summary');
 
 const PUBLIC = path.join(__dirname, '..', 'public');
 // 管理者専用のファイル（public の外に置き、管理者の Cookie があるときだけ返す）
@@ -96,12 +98,33 @@ app.use(
     index: false,
     dotfiles: 'deny',
     // カード画像を毎回読み込まないよう、本人のブラウザにだけキャッシュさせる
-    setHeaders: (res) => res.setHeader('Cache-Control', 'private, max-age=86400'),
+    // （スクリプトと CSS は更新がすぐ反映されるよう毎回確認させる）
+    setHeaders: (res, file) =>
+      res.setHeader('Cache-Control', file.endsWith('.png') ? 'private, max-age=86400' : 'private, no-cache'),
   })
 );
 
+// ---------- 管理者専用: レビュー付きCPU戦の振り返り ----------
+app.get('/review', auth.requireAdmin, page('review.html', ADMIN));
+app.get('/api/reviews', auth.requireAdmin, async (req, res, next) => {
+  try {
+    res.json(await reviews.list());
+  } catch (err) {
+    next(err);
+  }
+});
+app.get('/api/reviews/:id', auth.requireAdmin, async (req, res, next) => {
+  try {
+    const session = await reviews.get(req.params.id);
+    if (!session) return res.status(404).json({ error: '見つかりません' });
+    res.json({ ...session, summary: summarize(session.hands) });
+  } catch (err) {
+    next(err);
+  }
+});
+
 app.get('/api/me', (req, res) => res.json({ admin: auth.isAdmin(req) }));
-app.get('/api/tables', (req, res) => res.json(tables.list()));
+app.get('/api/tables', (req, res) => res.json(tables.list(auth.isAdmin(req))));
 app.get('/api/tables/suggest-name', (req, res) => res.json({ name: tables.suggestName() }));
 
 const intIn = (v, min, max) => Number.isInteger(v) && v >= min && v <= max;
@@ -125,8 +148,12 @@ app.post('/api/tables', (req, res) => {
   if (!intIn(smallBlind, 1, startingStack)) return res.status(400).json({ error: 'SBが不正です' });
   if (!intIn(bigBlind, smallBlind + 1, startingStack)) return res.status(400).json({ error: 'BBはSBより大きく・開始スタック以下にしてください' });
   if (blindTimerEnabled && !intIn(blindIntervalMin, 1, 240)) return res.status(400).json({ error: 'インターバルは1〜240分で入力してください' });
-  if (!MODES.includes(mode)) return res.status(400).json({ error: 'テーブルの種類が不正です' });
-  if (mode === 'cpu' && !intIn(cpuCount, 1, config.MAX_SEATS - 1)) {
+  // レビュー付きCPU戦は管理者だけが作れる
+  if (!MODES.includes(mode) || (mode === 'review' && !auth.isAdmin(req))) {
+    return res.status(400).json({ error: 'テーブルの種類が不正です' });
+  }
+  const withBots = mode === 'cpu' || mode === 'review';
+  if (withBots && !intIn(cpuCount, 1, config.MAX_SEATS - 1)) {
     return res.status(400).json({ error: `CPU の人数は1〜${config.MAX_SEATS - 1}人にしてください` });
   }
   if (!hostToken) return res.status(400).json({ error: 'プレイヤーIDがありません' });
@@ -139,7 +166,7 @@ app.post('/api/tables', (req, res) => {
     blindTimerEnabled,
     blindIntervalMin: blindTimerEnabled ? blindIntervalMin : 10,
     mode,
-    cpuCount: mode === 'cpu' ? cpuCount : 0,
+    cpuCount: withBots ? cpuCount : 0,
     hostToken,
   });
   broadcastLobby();
@@ -183,8 +210,10 @@ function broadcastTable(table) {
   for (const s of sockets) s.emit('table:state', table.publicState(s.data.token, connected));
 }
 
+// レビュー付きCPU戦は管理者のロビーにだけ出す
 function broadcastLobby() {
-  io.to('lobby').emit('lobby:tables', tables.list());
+  io.to('lobby').emit('lobby:tables', tables.list(false));
+  io.to('lobby:admin').emit('lobby:tables', tables.list(true));
 }
 
 function changed(table) {
@@ -211,6 +240,7 @@ io.use((socket, next) => {
 
 io.on('connection', (socket) => {
   const reply = (ack, payload) => typeof ack === 'function' && ack(payload);
+  socket.data.admin = auth.isAdminCookieHeader(socket.handshake.headers.cookie);
 
   // イベントの連打を制限
   let windowStart = Date.now();
@@ -226,8 +256,8 @@ io.on('connection', (socket) => {
   });
 
   socket.on('lobby:subscribe', () => {
-    socket.join('lobby');
-    socket.emit('lobby:tables', tables.list());
+    socket.join(socket.data.admin ? 'lobby:admin' : 'lobby');
+    socket.emit('lobby:tables', tables.list(socket.data.admin));
   });
 
   socket.on('table:join', (p, ack) => {
@@ -238,6 +268,10 @@ io.on('connection', (socket) => {
     const name = cleanText(p.name, 12);
     if (!token) return reply(ack, { ok: false, error: 'BAD_TOKEN' });
     if (!name) return reply(ack, { ok: false, error: 'NAME_REQUIRED' });
+    // レビュー付きCPU戦は作成者（管理者）だけが入れる。ほかの人にはテーブルがあることも見せない
+    if (table.mode === 'review' && !(socket.data.admin && token === table.hostToken)) {
+      return reply(ack, { ok: false, error: 'NOT_FOUND' });
+    }
 
     const prev = socket.data.tableId && tables.get(socket.data.tableId);
     if (prev && prev !== table) {
@@ -278,6 +312,7 @@ io.on('connection', (socket) => {
     'table:sitOut': (t, token) => t.setSittingOut(token, true),
     'table:sitIn': (t, token) => t.setSittingOut(token, false),
     'table:rebuy': (t, token) => t.rebuy(token),
+    'table:next': (t, token) => t.reviewNext(token),
   };
   for (const [event, fn] of Object.entries(actions)) {
     socket.on(event, (p, ack) => {