Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/schemas/auth-schema.ts

@@ -6,18 +6,6 @@ const IdentifierSchema = z
     .min(1, "Please enter your email or username")
     .max(320);
 
-const CodeSchema = z
-    .string()
-    .trim()
-    .min(1, "Please enter your code")
-    .max(32);
-
-export const LoginIdentifierRequestSchema = z.object({
-    login: z.object({
-        email_or_username: IdentifierSchema,
-    }),
-});
-
 export const PasswordLoginRequestSchema = z.object({
     login: z.object({
         email_or_username: IdentifierSchema,
@@ -28,10 +16,6 @@ export const PasswordLoginRequestSchema = z.object({
     }),
 });
 
-export const LoginCodeRequestSchema = z.object({
-    sso_code: CodeSchema,
-});
-
 export const SignupRequestSchema = z.object({
     signup: z.object({
         first_name: z
@@ -46,19 +30,10 @@ export const SignupRequestSchema = z.object({
             .min(3, "Usernames must be at least 3 characters")
             .max(32, "Usernames must be at most 32 characters"),
         email: z.email("Please enter a valid email address"),
-        password: z.string().max(128).optional(),
+        password: z.string().min(1, "Please enter a password").max(128),
     }),
 });
 
-export const ResetPasswordRequestSchema = z.object({
-    sso_code: CodeSchema,
-    new_password: z
-        .string()
-        .min(1, "Please enter a new password")
-        .max(128),
-});
-
 export const GoogleLoginRequestSchema = z.object({
     google_token: z.string().min(1, "No Google token was provided"),
-    google_signup: z.boolean().optional(),
 });