Add admin portal for editing individual question text by _id

[Copilot]

Adds /admin/question-management/question page and corresponding API endpoints for editing tossup and bonus text fields by _id, with HTML sanitization (allowing only <b>, <i>, <u>) and automatic _sanitized field regeneration.

API (/api/admin/question-management/question/)

• PUT /update-tossup — accepts { _id, question?, answer? }, updates text + question_sanitized/answer_sanitized
• PUT /update-bonus — accepts { _id, leadin?, parts?, answers? }, validates parts/answers are arrays of exactly 3 strings, updates text + corresponding _sanitized fields

Uses DOMPurify server-side (already a dependency) for both allowlisted-tag sanitization and full-strip for _sanitized fields:

const ALLOWED_TAGS = ['b', 'i', 'u'];
$set.question = DOMPurify.sanitize(question, { ALLOWED_TAGS });
$set.question_sanitized = DOMPurify.sanitize(question, { ALLOWED_TAGS: [] });

Client

• New page at client/admin/question-management/question.html — load by _id, preview current state, edit in textareas, save
• Linked from the Question Management card on the admin index

Files

• New: database/qbreader/admin/update-question.js, routes/api/admin/question-management/question.js, client/admin/question-management/question.{html,js}
• Modified: routes/api/admin/question-management/index.js (mount new router), client/admin/index.html (add button)

Original prompt

Create an admin portal under /admin/question-management where the user can edit individual tossups and bonus text by question _id, while respecting the HTML tags , , and respecting the consistency of the _sanitized fields. You will also have to create new api endpoints under /api/admin

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.