feat: 实现文件夹和书签的持久排序与拖拽功能

openspec/specs/api/spec.md

@@ -45,3 +45,21 @@ The system SHALL support last-write-wins (LWW) synchronization for folders and b
 - **THEN** the server stores the items using LWW semantics
 - **WHEN** the client calls `GET /sync/pull`
 - **THEN** the server returns folders/bookmarks and `serverTime`
+
+### Requirement: Admin user management (email-based)
+The system SHALL treat exactly one configured email as an administrator and allow that user to manage/view users.
+
+#### Scenario: Non-admin cannot access admin APIs
+- **GIVEN** an authenticated user whose email is not equal to `ADMIN_EMAIL`
+- **WHEN** the user calls `GET /admin/users`
+- **THEN** the server returns a 403 error
+
+#### Scenario: Admin can list users
+- **GIVEN** an authenticated user whose email equals `ADMIN_EMAIL`
+- **WHEN** the user calls `GET /admin/users`
+- **THEN** the server returns `200` and a list of users
+
+#### Scenario: Admin can view a user's bookmarks
+- **GIVEN** an authenticated admin user
+- **WHEN** the admin calls `GET /admin/users/{id}/bookmarks`
+- **THEN** the server returns `200` and that user's bookmarks