user admin capability

lib/providers/auth_provider.dart

@@ -26,6 +26,13 @@ class AuthController extends ChangeNotifier {
 
   RecordModel? get user => _client?.authStore.record;
 
+  /// True when PocketBase `usersapp.is_admin` is set for this account.
+  bool get isAdmin {
+    final record = user;
+    if (record == null) return false;
+    return record.getBoolValue('is_admin');
+  }
+
   String? get email {
     final value = user?.getStringValue('email');
     return value == null || value.isEmpty ? null : value;
@@ -80,6 +87,17 @@ class AuthController extends ChangeNotifier {
     notifyListeners();
   }
 
+  /// Refresh the auth record (e.g. after `is_admin` was toggled in Admin UI).
+  Future<void> refreshSession() async {
+    if (!isLoggedIn) return;
+    try {
+      await client.collection(kPocketBaseUsersCollection).authRefresh();
+    } catch (error, stackTrace) {
+      debugPrint('AuthController.refreshSession failed: $error\n$stackTrace');
+    }
+    notifyListeners();
+  }
+
   Future<void> logout() async {
     client.authStore.clear();
     notifyListeners();

lib/providers/bank_provider.dart

@@ -161,6 +161,40 @@ class BankController extends ChangeNotifier {
     notifyListeners();
   }
 
+  /// Insert a locally created transaction (admin testing). Persisted like CSV
+  /// imports and included in PocketBase `transactions` sync.
+  Future<BankTransaction> addManualTransaction({
+    required DateTime date,
+    required String description,
+    required double amount,
+    String currency = 'EUR',
+    bool pending = false,
+  }) async {
+    final desc = description.trim().isEmpty ? 'Test transaction' : description.trim();
+    // Include a short unique suffix so identical drafts do not collide on id.
+    final stamp = DateTime.now().millisecondsSinceEpoch % 100000;
+    final tx = BankTransaction(
+      date:
+          '${date.year.toString().padLeft(4, '0')}-'
+          '${date.month.toString().padLeft(2, '0')}-'
+          '${date.day.toString().padLeft(2, '0')}',
+      description: '$desc ·#$stamp',
+      amount: amount,
+      currency: currency.trim().isEmpty ? 'EUR' : currency.trim().toUpperCase(),
+      pending: pending,
+    );
+
+    _importedTransactions = mergeTransactions(_importedTransactions, [tx]);
+    _importedTransactions = filterNewTransactions(
+      _remoteTransactions,
+      _importedTransactions,
+    );
+    _invalidateMerged();
+    await _persistImported();
+    notifyListeners();
+    return tx;
+  }
+
   /// Union cloud txs into the local bank cache without dropping either side.
   ///
   /// Rows land in the API cache; CSV imports that match are deduped away.