🚫 Block /admin on mobile devices via user-agent check

server.js

@@ -313,6 +313,10 @@ app.get('/health', (req, res) => res.json({ status: 'ok' }));
 
 // ── Serve HTML ──────────────────────────────────────────────────────────────
 app.get('/admin', (req, res) => {
+  const ua = (req.get('user-agent') || '').toLowerCase();
+  if (/mobile|android|iphone|ipod|blackberry|webos/i.test(ua)) {
+    return res.status(403).send('Admin is not available on mobile devices.');
+  }
   res.sendFile(path.join(__dirname, 'public', 'admin.html'));
 });