Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/auth/create-super-admin-user.ts

@@ -0,0 +1,70 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type {
+    BUN_SQLITE_COBBLE_USERS,
+    BUN_SQLITE_COBBLE_USER_TYPES,
+    BunSQLiteTables,
+} from "@/db/types/db";
+import AppError from "@/src/utils/app-error";
+
+type Params = {
+    first_name: string;
+    last_name?: string;
+    email: string;
+    username: string;
+};
+
+/**
+ * Creates the first account on a fresh install with the `super_admin`
+ * user type and returns its id.
+ */
+export default async function createSuperAdminUser({
+    first_name,
+    last_name,
+    email,
+    username,
+}: Params) {
+    const new_user_res = await BunSQLite.insert<
+        BUN_SQLITE_COBBLE_USERS,
+        (typeof BunSQLiteTables)[number]
+    >({
+        table: "users",
+        data: [
+            {
+                first_name,
+                last_name: last_name || "",
+                email,
+                username,
+            },
+        ],
+    });
+
+    /**
+     * bun-sqlite inserts with `RETURNING *` by default, so the new row
+     * comes back as `singleRes` (with `insertId` as a fallback).
+     */
+    const new_user_id =
+        new_user_res.singleRes?.id || new_user_res.postInsertReturn?.insertId;
+
+    if (!new_user_id) {
+        throw new AppError(`Couldn't create your account. Please try again.`);
+    }
+
+    const type_res = await BunSQLite.insert<
+        BUN_SQLITE_COBBLE_USER_TYPES,
+        (typeof BunSQLiteTables)[number]
+    >({
+        table: "user_types",
+        data: [
+            {
+                user_id: new_user_id,
+                user_type: "super_admin",
+            },
+        ],
+    });
+
+    if (!type_res.success) {
+        throw new AppError(`Couldn't create your account. Please try again.`);
+    }
+
+    return new_user_id;
+}