Make Cobble a local install: setup flow, bots-first admin, settings

Local, password-only auth:
- No public pages; everything outside /admin and /auth redirects in
- First run (no users) sends every page to /auth/signup, which creates
  the super admin (user #1) once and then locks
- Login is email/username + password; removed the emailed-code flow,
  /auth/sso and email password reset
- Google login kept for existing accounts only, never creates them
- seed-super-admin now requires SEED_SUPER_ADMIN_PASSWORD

Bots-first admin:
- /admin and closed sections (people, logs, backups) redirect to
  /admin/bots; only bots and settings are live (AdminSections)
- Removed the old admin layout; every /admin page uses the bots rail
- Coordinator bot created at signup/seed and by /admin/bots
  (ensureCoordinatorBot), which redirects to its chat
- bots.system_prompt (markdown) with a default coordinator prompt
- seed-bots reuses the existing coordinator

Settings:
- Sub pages general (default), profile, change-password, listed in the
  rail with a back link; unknown settings paths redirect to general
- Redesigned settings UI: pane header, grouped rows, sticky save bar
- General: System/Light/Dark theme, saved per device

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/is-admin-section-path.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from "bun:test";
+import isAdminSectionPath from "./is-admin-section-path";
+
+describe("isAdminSectionPath", () => {
+    test("allows live sections and their sub pages", () => {
+        expect(isAdminSectionPath({ pathname: "/admin/bots" })).toBe(true);
+        expect(isAdminSectionPath({ pathname: "/admin/bots/3" })).toBe(true);
+        expect(isAdminSectionPath({ pathname: "/admin/settings/change-password" })).toBe(
+            true,
+        );
+    });
+
+    test("rejects the admin root, closed sections and lookalikes", () => {
+        expect(isAdminSectionPath({ pathname: "/admin" })).toBe(false);
+        expect(isAdminSectionPath({ pathname: "/admin/people" })).toBe(false);
+        expect(isAdminSectionPath({ pathname: "/admin/logs" })).toBe(false);
+        expect(isAdminSectionPath({ pathname: "/admin/botsx" })).toBe(false);
+    });
+});

src/utils/is-admin-section-path.ts

@@ -0,0 +1,14 @@
+import { AdminSections } from "@/src/dict/admin-sections-dict";
+
+type Params = {
+    pathname: string;
+};
+
+/**
+ * Whether `pathname` is one of the live `AdminSections` or a page under one.
+ */
+export default function isAdminSectionPath({ pathname }: Params) {
+    return AdminSections.some(
+        (section) => pathname == section || pathname.startsWith(`${section}/`),
+    );
+}

src/utils/is-unknown-settings-path.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from "bun:test";
+import isUnknownSettingsPath from "./is-unknown-settings-path";
+
+describe("isUnknownSettingsPath", () => {
+    test("known settings pages and the settings root are not unknown", () => {
+        expect(isUnknownSettingsPath({ pathname: "/admin/settings" })).toBe(false);
+        expect(isUnknownSettingsPath({ pathname: "/admin/settings/" })).toBe(false);
+        expect(
+            isUnknownSettingsPath({ pathname: "/admin/settings/profile" }),
+        ).toBe(false);
+        expect(
+            isUnknownSettingsPath({ pathname: "/admin/settings/change-password/" }),
+        ).toBe(false);
+    });
+
+    test("other settings paths are unknown; non-settings paths are not", () => {
+        expect(
+            isUnknownSettingsPath({ pathname: "/admin/settings/password" }),
+        ).toBe(true);
+        expect(
+            isUnknownSettingsPath({ pathname: "/admin/settings/profilex" }),
+        ).toBe(true);
+        expect(isUnknownSettingsPath({ pathname: "/admin/bots/1" })).toBe(false);
+    });
+});

src/utils/is-unknown-settings-path.ts

@@ -0,0 +1,21 @@
+import { SettingsPages } from "@/src/dict/settings-pages-dict";
+
+type Params = {
+    pathname: string;
+};
+
+/**
+ * Whether `pathname` is under `/admin/settings/` but not one of the
+ * `SettingsPages` (or a page nested under one).
+ */
+export default function isUnknownSettingsPath({ pathname }: Params) {
+    const current = pathname.replace(/\/$/, "");
+
+    if (!current.startsWith("/admin/settings/")) {
+        return false;
+    }
+
+    return !SettingsPages.some(
+        (page) => current == page.url || current.startsWith(`${page.url}/`),
+    );
+}

src/utils/parse-login-method.test.ts

@@ -1,19 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import parseLoginMethod from "./parse-login-method";
-
-describe("parseLoginMethod", () => {
-    test("reads password", () => {
-        expect(parseLoginMethod({ value: "password" })).toBe("password");
-        expect(parseLoginMethod({ value: " Password " })).toBe("password");
-    });
-
-    test("reads code", () => {
-        expect(parseLoginMethod({ value: "code" })).toBe("code");
-    });
-
-    test("falls back to code when unset or unknown", () => {
-        expect(parseLoginMethod({})).toBe("code");
-        expect(parseLoginMethod({ value: "" })).toBe("code");
-        expect(parseLoginMethod({ value: "passwrd" })).toBe("code");
-    });
-});

src/utils/parse-login-method.ts

@@ -1,14 +0,0 @@
-import type { LoginMethod } from "@/src/types";
-
-type Params = {
-    value?: string | null;
-};
-
-/**
- * Reads the site-wide login method (`AUTH_LOGIN_METHOD`). Anything other
- * than `password` falls back to passwordless `code` login, so a typo can
- * never lock out accounts that have no password.
- */
-export default function parseLoginMethod({ value }: Params): LoginMethod {
-    return value?.trim().toLowerCase() == "password" ? "password" : "code";
-}

src/utils/resolve-theme.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import resolveTheme from "./resolve-theme";
+
+describe("resolveTheme", () => {
+    test("an explicit choice wins over the device", () => {
+        expect(resolveTheme({ preference: "light", system_is_dark: true })).toBe(
+            "light",
+        );
+        expect(resolveTheme({ preference: "dark", system_is_dark: false })).toBe(
+            "dark",
+        );
+    });
+
+    test("system follows the device", () => {
+        expect(resolveTheme({ preference: "system", system_is_dark: true })).toBe(
+            "dark",
+        );
+        expect(
+            resolveTheme({ preference: "system", system_is_dark: false }),
+        ).toBe("light");
+    });
+});

src/utils/resolve-theme.ts

@@ -0,0 +1,20 @@
+import type { ThemePreference } from "@/src/dict/theme-preferences-dict";
+
+type Params = {
+    preference: ThemePreference;
+    system_is_dark: boolean;
+};
+
+/**
+ * The scheme to put on `<html>` for a preference.
+ */
+export default function resolveTheme({
+    preference,
+    system_is_dark,
+}: Params): "light" | "dark" {
+    if (preference == "system") {
+        return system_is_dark ? "dark" : "light";
+    }
+
+    return preference;
+}