Update dashboard JS and frontend class

includes/class-hssm-admin.php

@@ -45,7 +45,22 @@ class HSSM_Admin {
      * @since 1.0.0
      */
     public function add_menus() {
-        // Add settings page under the Slides menu
+        $plugin_mode = get_option( 'hssm_plugin_mode', 'manager' );
+
+        // Client mode does not register the slides CPT, so Settings cannot hang off that menu.
+        if ( 'client' === $plugin_mode ) {
+            add_menu_page(
+                __( 'Slide Manager', 'hi-school-slide-manager' ),
+                __( 'Slide Manager', 'hi-school-slide-manager' ),
+                'manage_options',
+                'hssm-settings',
+                array( $this, 'settings_page' ),
+                'dashicons-images-alt2',
+                58
+            );
+            return;
+        }
+
         add_submenu_page(
             'edit.php?post_type=hssm_slide',
             __( 'Slide Manager Settings', 'hi-school-slide-manager' ),
@@ -54,8 +69,7 @@ class HSSM_Admin {
             'hssm-settings',
             array( $this, 'settings_page' )
         );
-        
-        // Add API documentation page
+
         add_submenu_page(
             'edit.php?post_type=hssm_slide',
             __( 'API Documentation', 'hi-school-slide-manager' ),
@@ -79,6 +93,7 @@ class HSSM_Admin {
         register_setting( 'hssm_settings', 'hssm_notification_emails' );
         register_setting( 'hssm_settings', 'hssm_cache_duration' );
         register_setting( 'hssm_settings', 'hssm_api_keys' );
+        register_setting( 'hssm_settings', 'hssm_client_api_key' );
         
         // Add settings sections
         add_settings_section(
@@ -127,6 +142,14 @@ class HSSM_Admin {
             'hssm_general'
         );
 
+        add_settings_field(
+            'hssm_client_api_key',
+            __( 'Client API Key', 'hi-school-slide-manager' ),
+            array( $this, 'client_api_key_field' ),
+            'hssm-settings',
+            'hssm_general'
+        );
+
         add_settings_field(
             'hssm_cache_duration',
             __( 'Cache Duration', 'hi-school-slide-manager' ),
@@ -192,7 +215,7 @@ class HSSM_Admin {
                     <li><code><?php echo esc_html( rest_url( 'hssm/v1/slide/{id}' ) ); ?></code> - Get single slide</li>
                     <li><code><?php echo esc_html( rest_url( 'hssm/v1/health' ) ); ?></code> - Health check (no auth required)</li>
                 </ul>
-                <p><strong><?php _e( 'Authentication:', 'hi-school-slide-manager' ); ?></strong> <?php _e( 'Include API key in X-HSSM-API-Key header or api_key parameter', 'hi-school-slide-manager' ); ?></p>
+                <p><strong><?php _e( 'Authentication:', 'hi-school-slide-manager' ); ?></strong> <?php _e( 'Include an API key from the list below in the X-HSSM-API-Key header or api_key parameter. On each companion site, paste that same key into Settings → Client API Key.', 'hi-school-slide-manager' ); ?></p>
             </div>
         </div>
         <?php
@@ -386,6 +409,9 @@ Headers: X-HSSM-API-Key: your-api-key</code></pre>
             if ( isset( $_POST['hssm_client_site_slug'] ) ) {
                 update_option( 'hssm_client_site_slug', sanitize_text_field( $_POST['hssm_client_site_slug'] ) );
             }
+            if ( isset( $_POST['hssm_client_api_key'] ) ) {
+                update_option( 'hssm_client_api_key', sanitize_text_field( wp_unslash( $_POST['hssm_client_api_key'] ) ) );
+            }
             if ( isset( $_POST['hssm_cache_duration'] ) ) {
                 update_option( 'hssm_cache_duration', absint( $_POST['hssm_cache_duration'] ) );
             }
@@ -437,7 +463,7 @@ Headers: X-HSSM-API-Key: your-api-key</code></pre>
      * API section callback
      */
     public function api_section_callback() {
-        echo '<p>' . __( 'Manage API keys for companion sites.', 'hi-school-slide-manager' ) . '</p>';
+        echo '<p>' . __( 'Generate keys on the Manager site, then paste one into each companion site under Client API Key.', 'hi-school-slide-manager' ) . '</p>';
     }
     
     /**
@@ -482,6 +508,15 @@ Headers: X-HSSM-API-Key: your-api-key</code></pre>
         <?php
     }
 
+    /**
+     * Client API key field
+     */
+    public function client_api_key_field() {
+        $value = get_option( 'hssm_client_api_key', '' );
+        echo '<input type="text" name="hssm_client_api_key" value="' . esc_attr( $value ) . '" class="regular-text" autocomplete="off" />';
+        echo '<p class="description">' . esc_html__( 'Used only in Client mode. Copy a key from the Manager site (Settings → API Keys) and paste it here. Requests fail with 403 until this matches a manager key.', 'hi-school-slide-manager' ) . '</p>';
+    }
+
     /**
      * Cache duration field
      */
@@ -531,7 +566,7 @@ Headers: X-HSSM-API-Key: your-api-key</code></pre>
         }
         
         echo '<p><button type="submit" name="generate_api_key" value="1" class="button button-secondary">' . __( 'Generate New API Key', 'hi-school-slide-manager' ) . '</button></p>';
-        echo '<p class="description">' . __( 'API keys are used by companion sites to authenticate and fetch slides.', 'hi-school-slide-manager' ) . '</p>';
+        echo '<p class="description">' . __( 'Generate a key on this Manager site, then paste it into each companion site under Settings → Client API Key.', 'hi-school-slide-manager' ) . '</p>';
         
         echo '</div>';