Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/scripts/seed-super-admin.tsx

@@ -4,6 +4,9 @@ import type {
     BUN_SQLITE_COBBLE_USERS,
     BunSQLiteTables,
 } from "@/db/types/db";
+import setUserPassword from "@/src/functions/backend/auth/set-user-password";
+import validatePassword from "@/src/utils/validate-password";
+import ensureCoordinatorBot from "@/src/functions/backend/db/bots/ensure-coordinator-bot";
 
 const FIRST_NAME = process.env.SEED_SUPER_ADMIN_FIRST_NAME || "Super";
 const LAST_NAME = process.env.SEED_SUPER_ADMIN_LAST_NAME || "Admin";
@@ -11,8 +14,16 @@ const EMAIL =
     process.env.SEED_SUPER_ADMIN_EMAIL || "[email protected]";
 const USERNAME =
     process.env.SEED_SUPER_ADMIN_USERNAME || "super_admin";
+const PASSWORD = process.env.SEED_SUPER_ADMIN_PASSWORD;
 
 async function seedSuperAdmin() {
+    const password_error = validatePassword({ password: PASSWORD });
+
+    if (password_error || !PASSWORD) {
+        console.error(`SEED_SUPER_ADMIN_PASSWORD: ${password_error}`);
+        process.exit(1);
+    }
+
     const existing = (
         await BunSQLite.select<
             BUN_SQLITE_COBBLE_USERS,
@@ -80,6 +91,12 @@ async function seedSuperAdmin() {
         })
     ).payload?.[0];
 
+    await setUserPassword({ user_id: Number(user_id), password: PASSWORD });
+    console.log(`Set the password for user #${user_id}.`);
+
+    const coordinator_id = await ensureCoordinatorBot({ user_id });
+    console.log(`Coordinator bot is #${coordinator_id}.`);
+
     if (has_super_admin) {
         console.log(`User #${user_id} already has the super_admin type.`);
         return;
@@ -109,6 +126,6 @@ async function seedSuperAdmin() {
 await seedSuperAdmin();
 
 console.log(
-    `Seed complete. Log in via SSO code sent to ${EMAIL} at /auth/login.`,
+    `Seed complete. Log in as ${EMAIL} or ${USERNAME} at /auth/login.`,
 );
 process.exit(0);