Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/data/app-data.ts

@@ -2,10 +2,10 @@ import { SiteData } from "./site-data";
 
 export const AppData = {
     HashCost: 12,
-    SSOAuthCookieName: `${SiteData["SiteSlug"]}_sso_auth`,
-    SSOCodeExpiryMinutes: 15,
-    SSOPendingLoginMaxMinutes: 60,
-    SSOPendingLoginStorageKey: `${SiteData["SiteSlug"]}_sso_pending_login`,
+    /**
+     * Shared with twui's `ColorSchemeSelector`, so it must stay `theme`.
+     */
+    ThemeStorageKey: "theme",
     ServerHealthMessage: "Server Running Well",
     AuthKeyCookieName: `${SiteData["SiteSlug"]}_auth_key`,
     AuthCSRFCookieName: `${SiteData["SiteSlug"]}_auth_csrf`,
@@ -20,8 +20,6 @@ export const AppData = {
     ImageQuality: 85,
     ImageThumbnailQuality: 70,
     PaystackEndpoint: "https://api.paystack.co",
-    SSOMaxCodeAttempts: 5,
-    SSOCodeRequestLimit: 5,
     ContactFormLimit: 5,
     RateLimitWindowMinutes: 15,
     UsernameRegex: /^[a-z0-9._-]{3,32}$/,