admin: user accounts and session login

The admin was one shared HTTP Basic login: no way to give someone
partial access, revoke one person, or tell who changed what. Add a users
table and a session login form. Passwords are scrypt hashes from Ruby's
OpenSSL, so no native gem is needed. Sessions carry a per-user version
that is bumped on password change, which logs that user out everywhere.

ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty
table and afterwards only work while no active superuser exists, as a
recovery path that re-creates one. Until per-area permissions land,
non-superusers only reach the dashboard and their own password page.

Assisted-by: Claude:opus-5

views/admin/_nav.erb

@@ -2,4 +2,10 @@
     <% [['/admin', 'dashboard'], ['/admin/invoices', 'invoices'], ['/admin/bingo', 'bingo']].each do |href, label| %>
         <a href="<%= href %>" class="<%= 'active' if href == '/admin' ? request.path == '/admin' : request.path.start_with?(href) %>"><%= label %></a>
     <% end %>
+    <% if current_user %>
+        <span class="admin-nav-user">
+            <a href="/admin/account/password" title="Change password"><%= current_user.username %></a>
+            <form method="post" action="/admin/logout"><input type="hidden" name="authenticity_token" value="<%= csrf_token %>" /><button type="submit" class="link-button">log out</button></form>
+        </span>
+    <% end %>
 </nav>

views/admin/account_password.erb

@@ -0,0 +1,17 @@
+<%== erb :'admin/_nav', layout: false %>
+<div class="header">
+    <h1>Change password</h1>
+    <% if current_user.must_change_password %><p class="tagline">Set a new password to continue.</p><% end %>
+</div>
+
+<section class="section">
+    <% if @error %><div class="form-error-base"><div><%= @error %></div></div><% end %>
+    <form class="invoice-form auth-form" method="post" action="/admin/account/password">
+        <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
+        <input type="text" name="username" value="<%= current_user.username %>" autocomplete="username" hidden />
+        <div class="field"><label for="current">Current password</label><input type="password" id="current" name="current" autocomplete="current-password" required /></div>
+        <div class="field"><label for="password">New password <span class="optional">(at least <%= User::MIN_PASS %> characters)</span></label><input type="password" id="password" name="password" autocomplete="new-password" minlength="<%= User::MIN_PASS %>" required /></div>
+        <div class="field"><label for="confirm">Repeat new password</label><input type="password" id="confirm" name="confirm" autocomplete="new-password" required /></div>
+        <button type="submit" class="download-button">Change password</button>
+    </form>
+</section>

views/admin/login.erb

@@ -0,0 +1,15 @@
+<div class="header">
+    <h1>Admin</h1>
+    <p class="tagline">asxp.io</p>
+</div>
+
+<section class="section">
+    <% if @error %><div class="form-error-base"><div><%= @error %></div></div><% end %>
+    <form class="invoice-form auth-form" method="post" action="/admin/login">
+        <input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
+        <input type="hidden" name="next" value="<%= @next %>" />
+        <div class="field"><label for="username">Username</label><input type="text" id="username" name="username" value="<%= params[:username] %>" autocomplete="username" autocapitalize="none" required autofocus /></div>
+        <div class="field"><label for="password">Password</label><input type="password" id="password" name="password" autocomplete="current-password" required /></div>
+        <button type="submit" class="download-button">Log in</button>
+    </form>
+</section>