Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/auth/signup/(functions)/submit-signup-form.ts

@@ -1,31 +1,25 @@
 import fetchApi from "@moduletrace/twui/utils/fetch/fetchApi";
+import { AdminHomePath } from "@/src/dict/admin-sections-dict";
 import type useFormInit from "@/src/hooks/use-form-init";
-import type { ApiReqParams, LoginMethod, SignupFormObject } from "@/src/types";
+import type { ApiReqParams, SignupFormObject } from "@/src/types";
 import type { APIResponseObject } from "@moduletrace/bunext/types";
-import saveSSOPendingLogin from "@/src/functions/frontend/save-sso-pending-login";
 import validatePassword from "@/src/utils/validate-password";
 
-type Params = ReturnType<typeof useFormInit<SignupFormObject>> & {
-    method: LoginMethod;
-};
+type Params = ReturnType<typeof useFormInit<SignupFormObject>>;
 
 export default async function submitSignupForm({
     setLoading,
     setStatus,
     form,
-    method,
 }: Params) {
-    const password_error =
-        method == "password"
-            ? validatePassword({ password: form.password })
-            : undefined;
+    const password_error = validatePassword({ password: form.password });
 
     if (password_error) {
         setStatus({ error: true, msg: password_error });
         return;
     }
 
-    if (method == "password" && form.password != form.confirm_password) {
+    if (form.password != form.confirm_password) {
         setStatus({ error: true, msg: "The passwords don't match." });
         return;
     }
@@ -42,18 +36,14 @@ export default async function submitSignupForm({
                     last_name: form.last_name,
                     username: form.username,
                     email: form.email,
-                    password: method == "password" ? form.password : undefined,
+                    password: form.password,
                 },
             },
         },
     );
 
     if (res.success) {
-        saveSSOPendingLogin({
-            identifier: form.email?.trim() || "",
-            method,
-        });
-        window.location.pathname = `/auth/sso`;
+        window.location.pathname = AdminHomePath;
     } else {
         setStatus({
             error: true,