Give the nav's dead links somewhere to land

Three of the app's routes were referenced but never existed, so the redesign's
navigation pointed at 404s from several directions.

/dashboard was the post-login and fallback redirect target in nine places --
login, onboarding, middleware, the admin/nodes/systems/tokens/settings guards,
and the marketing header -- but app/dashboard/ was never created. Signing in
normally dropped the user on a 404. The real signed-in home is "/", which
app/page.tsx already renders as LiveView for an authed user with an org, and
which the nav labels "Live"; all nine now point there.

Nav also linked /watch and /network, neither of which existed. /watch is the
alerts screen under its redesign name, so it re-exports app/alerts/page.tsx
and /alerts stays reachable for old links. /network is new: the "my equipment"
hub the redesign moved /nodes, /systems and /tokens behind and then never
built, which had left /systems and /tokens with no entry point in the UI at
all. Its hooks all run before the admin/operator guard, per d041c86.

Separately, the admin page's guard read isAdmin without authLoading, so every
cold load of /admin -- typed URL, hard refresh, bookmark -- redirected away
while the Firebase claims were still resolving. Admin was only reachable by
clicking through from an already-mounted page. Now it waits, like every other
guarded route does.

And /incidents no longer lies about an empty list: a failed Firestore query
leaves `incidents` empty just as a quiet night does, and the page was printing
"No incidents recorded yet" over the top of a missing-composite-index error.
useIncidents already returned `error`; the page just ignored it. It now renders
an ErrorBanner instead, so the undeployed indexes in server-26#13 read as a
failure rather than as silence on the radio.

Closes server-26#30, server-26#31. server-26#13 stays open -- the rules and
indexes still have to be pushed to the live project by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-frontend/app/admin/page.tsx

@@ -1062,14 +1062,20 @@ const TAB_LABELS: { key: AdminTab; label: string }[] = [
 ];
 
 export default function AdminPage() {
-  const { user, isAdmin } = useAuth();
+  const { user, isAdmin, loading: authLoading } = useAuth();
   const router = useRouter();
   const [tab, setTab] = useState<AdminTab>("features");
 
+  // Wait for the claims to resolve before deciding. isAdmin is false for the
+  // first render of every cold load (typed URL, hard refresh, bookmark) while
+  // AuthProvider fetches the ID token, so a guard that ignores authLoading
+  // redirects the admin off their own page every time and only ever lets them
+  // in via an in-app link. Same shape as /nodes, /systems and /settings.
   useEffect(() => {
-    if (!isAdmin) router.replace("/dashboard");
-  }, [isAdmin, router]);
+    if (!authLoading && !isAdmin) router.replace("/");
+  }, [authLoading, isAdmin, router]);
 
+  if (authLoading) return null;
   if (!isAdmin) return null;
 
   // Users/Audit tabs benefit from full width; everything else is narrow

drb-frontend/app/incidents/page.tsx

@@ -10,7 +10,7 @@ import type { IncidentRecord } from "@/lib/types";
 import { PageHeader } from "@/components/ui/PageHeader";
 import { Button } from "@/components/ui/Button";
 import { Badge } from "@/components/ui/Badge";
-import { EmptyState } from "@/components/ui/EmptyState";
+import { EmptyState, ErrorBanner } from "@/components/ui/EmptyState";
 import { SkeletonCard } from "@/components/ui/Skeleton";
 import { isKnownSeverity, severityRank } from "@/lib/severity";
 import { SeverityMark, SeveritySpine } from "@/components/marks/SeverityMark";
@@ -166,7 +166,7 @@ function CreateModal({ onClose, onCreate }: { onClose: () => void; onCreate: (bo
 
 export default function IncidentsPage() {
   const { isAdmin } = useAuth();
-  const { incidents, loading } = useIncidents();
+  const { incidents, loading, error } = useIncidents();
   const activeCalls = useActiveCalls();
   const [showCreate, setShowCreate] = useState(false);
   const [severityFilter, setSeverityFilter] = useState<SeverityFilter>("all");
@@ -275,7 +275,16 @@ export default function IncidentsPage() {
             </section>
           ))}
 
-          {filtered.length === 0 && (
+          {/* An empty list is only news when the query actually succeeded.
+              A failed Firestore query (missing composite index, denied rules)
+              also leaves `incidents` empty, and rendering "no incidents
+              recorded yet" over the top of it told the operator the radio was
+              quiet when the page had simply failed to load — server-26#13. */}
+          {filtered.length === 0 && error && (
+            <ErrorBanner message={`Couldn't load incidents: ${error}`} />
+          )}
+
+          {filtered.length === 0 && !error && (
             <EmptyState
               title={incidents.length === 0 ? "No incidents recorded yet" : "No incidents match this filter"}
               description={

drb-frontend/app/login/page.tsx

@@ -20,7 +20,7 @@ export default function LoginPage() {
 
   // Do NOT navigate straight from the sign-in handlers below: signInWith*
   // resolves before AuthProvider's onAuthStateChanged listener has fetched
-  // claims and set/cleared the drb_session cookie. Pushing to /dashboard
+  // claims and set/cleared the drb_session cookie. Pushing to the home route
   // immediately races that — for a no-org account the cookie never gets
   // set, so middleware.ts bounces the very next request straight back to
   // /login, which is the ping-pong this screen used to cause. Instead,
@@ -31,7 +31,7 @@ export default function LoginPage() {
   useEffect(() => {
     if (authLoading) return;
     if (!user) return;
-    router.replace(orgId ? "/dashboard" : "/onboarding");
+    router.replace(orgId ? "/" : "/onboarding");
   }, [authLoading, user, orgId, router]);
 
   async function handleSubmit(e: React.FormEvent) {

drb-frontend/app/network/page.tsx

@@ -0,0 +1,104 @@
+"use client";
+
+// The nav's "Network" destination (components/Nav.tsx) — "my equipment".
+// The redesign added the link but never the route, so it 404'd and the three
+// screens behind it (/nodes, /systems, /tokens) had no entry point in the nav
+// at all. This is the hub: it counts what's there, surfaces nodes that still
+// need configuring, and hands off to the existing pages.
+
+import { useEffect } from "react";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useAuth } from "@/components/AuthProvider";
+import { useNodes } from "@/lib/useNodes";
+import { useSystems } from "@/lib/useSystems";
+import { PageHeader } from "@/components/ui/PageHeader";
+import { Card } from "@/components/ui/Card";
+import { Badge } from "@/components/ui/Badge";
+
+function HubCard({
+  href,
+  title,
+  description,
+  count,
+  countLabel,
+  badge,
+}: {
+  href: string;
+  title: string;
+  description: string;
+  count: number | null;
+  countLabel: string;
+  badge?: React.ReactNode;
+}) {
+  return (
+    <Link href={href} className="block">
+      <Card hover className="h-full">
+        <div className="flex items-start justify-between gap-3">
+          <h2 className="text-ink font-semibold text-sm">{title}</h2>
+          {badge}
+        </div>
+        <p className="text-ink-muted text-xs mt-1.5 leading-snug">{description}</p>
+        <p className="text-ink text-2xl font-mono mt-4">
+          {count === null ? "—" : count}
+          <span className="text-ink-muted text-xs font-sans ml-2">{countLabel}</span>
+        </p>
+      </Card>
+    </Link>
+  );
+}
+
+export default function NetworkPage() {
+  const { isAdmin, isOperator, loading: authLoading } = useAuth();
+  const router = useRouter();
+  const { nodes, loading: nodesLoading } = useNodes();
+  const { systems, loading: systemsLoading } = useSystems();
+
+  useEffect(() => {
+    if (!authLoading && !isAdmin && !isOperator) router.replace("/");
+  }, [authLoading, isAdmin, isOperator, router]);
+
+  // Every hook runs before this guard — see the note in app/nodes/page.tsx.
+  if (authLoading || (!isAdmin && !isOperator)) return null;
+
+  const pending = nodes.filter((n) => !n.configured);
+  const online = nodes.filter((n) => n.status === "online" || n.status === "recording");
+
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title="Network"
+        description="The equipment on your account — field nodes, the radio systems they decode, and the Discord bot tokens they use."
+      />
+
+      <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+        <HubCard
+          href="/nodes"
+          title="Nodes"
+          description="Field SDR nodes: status, location, and per-node configuration."
+          count={nodesLoading ? null : nodes.length}
+          countLabel={nodesLoading ? "" : `total · ${online.length} up`}
+          badge={
+            pending.length > 0 ? (
+              <Badge tone="warning">{pending.length} need setup</Badge>
+            ) : undefined
+          }
+        />
+        <HubCard
+          href="/systems"
+          title="Systems"
+          description="Radio system definitions — control channels, talkgroups, and per-system AI flags."
+          count={systemsLoading ? null : systems.length}
+          countLabel={systemsLoading ? "" : "configured"}
+        />
+        <HubCard
+          href="/tokens"
+          title="Bot Tokens"
+          description="Discord bot tokens available for nodes to claim when relaying live audio."
+          count={null}
+          countLabel="manage"
+        />
+      </div>
+    </div>
+  );
+}

drb-frontend/app/nodes/page.tsx

@@ -16,7 +16,7 @@ export default function NodesPage() {
   const { systems } = useSystems();
 
   useEffect(() => {
-    if (!authLoading && !isAdmin && !isOperator) router.replace("/dashboard");
+    if (!authLoading && !isAdmin && !isOperator) router.replace("/");
   }, [authLoading, isAdmin, isOperator, router]);
 
   const [configNode, setConfigNode] = useState<NodeRecord | null>(null);

drb-frontend/app/onboarding/page.tsx

@@ -29,7 +29,7 @@ export default function OnboardingPage() {
       return;
     }
     if (orgId) {
-      router.replace("/dashboard");
+      router.replace("/");
     }
   }, [loading, user, orgId, router]);
 

drb-frontend/app/settings/layout.tsx

@@ -27,7 +27,7 @@ export default function SettingsLayout({ children }: { children: React.ReactNode
   const router = useRouter();
 
   useEffect(() => {
-    if (!loading && !canAccess) router.replace("/dashboard");
+    if (!loading && !canAccess) router.replace("/");
   }, [loading, canAccess, router]);
 
   if (loading || !canAccess) return null;

drb-frontend/app/systems/page.tsx

@@ -1185,7 +1185,7 @@ export default function SystemsPage() {
   const { systems, loading } = useSystems();
 
   useEffect(() => {
-    if (!authLoading && !isAdmin && !isOperator) router.replace("/dashboard");
+    if (!authLoading && !isAdmin && !isOperator) router.replace("/");
   }, [authLoading, isAdmin, isOperator, router]);
 
   const [editing, setEditing]             = useState<SystemRecord | null | "new">(null);

drb-frontend/app/tokens/page.tsx

@@ -26,7 +26,7 @@ export default function TokensPage() {
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
-    if (!authLoading && !isAdmin && !isOperator) router.replace("/dashboard");
+    if (!authLoading && !isAdmin && !isOperator) router.replace("/");
   }, [authLoading, isAdmin, isOperator, router]);
 
   const refresh = useCallback(async () => {

drb-frontend/app/watch/page.tsx

@@ -0,0 +1,5 @@
+// The nav's "Watch" destination (components/Nav.tsx). The redesign renamed
+// Alerts to Watch but never added the route, so the nav link 404'd. The screen
+// itself is unchanged — it still lives in app/alerts/page.tsx, which stays
+// reachable so old links and bookmarks keep working.
+export { default } from "../alerts/page";