Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/api/admin/settings/update-password.ts

@@ -2,7 +2,6 @@ import userAuth from "@/src/functions/backend/auth/user-auth";
 import grabUserPasswordHash from "@/src/functions/backend/auth/grab-user-password-hash";
 import verifyUserPassword from "@/src/functions/backend/auth/verify-user-password";
 import setUserPassword from "@/src/functions/backend/auth/set-user-password";
-import grabLoginMethod from "@/src/functions/backend/auth/grab-login-method";
 import logEvent, { grabRequestIP } from "@/src/functions/backend/logger";
 import { AppData } from "@/src/data/app-data";
 import type { ApiReqParams } from "@/src/types";
@@ -14,8 +13,7 @@ import type {
 } from "@moduletrace/bunext/types";
 
 /**
- * Sets or changes the logged-in user's own password (password login mode
- * only). Acts only on the session user; changing an existing password
+ * Sets or changes the logged-in user's own password. Acts only on the session user; changing an existing password
  * needs the current one.
  */
 export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
@@ -37,10 +35,6 @@ export const handler: BunextAPIRouteHandler<APIResponseObject> = async ({
             };
         }
 
-        if (grabLoginMethod() != "password") {
-            throw new Error(`Password login is turned off.`);
-        }
-
         const user_id = user.id;
         const { password_update } = body as ApiReqParams;