Implement admin back-pass flow and guarded admin actions

SPEC.md

@@ -11,6 +11,7 @@ Help a small Discord group (4–8 players) pick a co-op game via phased flow:
 - Username/password login (cookie auth)
 - Admins flagged via admin key at registration
 - Per-user phase tracking; admins can move themselves backward, everyone can move forward (subject to admin “results open” toggle and Suggest→Vote requiring at least one own suggestion)
+- Admins can grant a one-time back pass so a voter can move from Vote back to Suggest once
 
 ## Suggest Phase
 - Up to **5 suggestions** per player
@@ -23,11 +24,13 @@ Help a small Discord group (4–8 players) pick a co-op game via phased flow:
 - All suggestions visible with authors
 - Score each suggestion 0–10
 - Players see only their own votes; can finalize/unfinalize their ballot
+- A player with a granted back pass can move from Vote back to Suggest exactly once (consumed on use)
 - **Linked games**: admins can link duplicates; linked games share a vote group. Moving a slider on one updates all linked siblings.
 - Linking or unlinking games clears votes for the linked group and unfinalizes **all** players so ballots can be reviewed again
 
 ## Results Phase
 - Visible only after admin enables results; players auto-advance when opened
+- When results are closed again, only players with one or more suggestions return to Vote; players without suggestions return to Suggest
 - Leaderboard sorted by average score; shows totals, counts, player’s own vote, and links/media
 
 ## Non-functional