feat: complete admin panel and backend admin api migration

apps/api/src/modules/admin-cities/admin-cities.controller.ts

@@ -0,0 +1,22 @@
+import { Controller, HttpCode, Post } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+
+/**
+ * Legacy `POST cities/list` — the city lookup the table filters use.
+ * Returns `{ rows }`, matching what the users store's setCities() reads.
+ *
+ * Deliberately NOT permission-gated: legacy called this from table models at
+ * module load, before any rid check, and it exposes nothing sensitive.
+ */
+@Controller('admin/cities')
+export class AdminCitiesController {
+  constructor(private readonly prisma: PrismaService) {}
+
+  @Post('list')
+  @HttpCode(200)
+  async list() {
+    const cities = await this.prisma.city.findMany({ orderBy: { name: 'asc' } });
+    // legacy shape: { id, title }
+    return { rows: cities.map((c) => ({ id: c.id, title: c.name, province: c.province })) };
+  }
+}

apps/api/src/modules/admin-cities/admin-cities.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PrismaModule } from '../../prisma/prisma.module';
+import { AdminCitiesController } from './admin-cities.controller';
+
+@Module({
+  imports: [PrismaModule],
+  controllers: [AdminCitiesController],
+})
+export class AdminCitiesModule {}