IPCR Forge admin: name, health, unpublish, allowlist, key backup

ipcr 1.3.0 (gateway/):
- admin API on ADMIN_LISTEN (Bearer token in STATE_DIR/admin-token):
  status (key, node, storage, IPNS record here and on the network via
  delegated routing, ENS/DNSLink name check), providers/announce, peers,
  images, unpublish (tombstone + unpin unused objects), retag, reimport,
  config (name, allowlist), republish, key import (restore with
  sequence = max(network, local) + 1; previous key kept, kept copies reused)
- watcher refactored into shared state; config.json with an allowlist
  (IMPORT_ALLOW_REQUIRED); staging cleanup after publish (IMPORT_CLEANUP)
- IPNS records published with IPNS_LIFETIME / IPNS_TTL; superseded trees
  unpinned
- encrypted publisher-key backups (PBKDF2 + AES-256-GCM), ipcrd key decrypt

bridge 0.2.0 (bridge/):
- /admin: Gitea OAuth2 login (PKCE, site admins only), signed session,
  same-origin + X-IPCR-Admin on writes; setup registers the OAuth2 app
- admin page: publisher name and ENS/DNS check, health, published images,
  per-repository publish toggles (pushed to IPCR as its allowlist), key
  export (from Kubo's keystore, encrypted) and restore
- public page pull lines use the verified name

Compose: ipcr-admin internal network, keystore mount, 7-day IPNS lifetime,
staging GC at registry start. Verified on holyhorse (docs/forge.md).

forge/web.go

@@ -13,7 +13,7 @@ var webFiles embed.FS
 // webHandler serves the forge's public page. Everything on it is public anyway: links, the
 // documentation, IPCR's list of published images (public on IPFS) and the list of mirrored
 // repositories (public on Radicle). Nothing here changes anything.
-func webHandler(st *state, publishedFile string) http.Handler {
+func webHandler(st *state, publishedFile string) *http.ServeMux {
 	mux := http.NewServeMux()
 	page, _ := webFiles.ReadFile("web/index.html")
 	icon, _ := webFiles.ReadFile("web/icon.png")
@@ -47,3 +47,29 @@ func webHandler(st *state, publishedFile string) http.Handler {
 	})
 	return mux
 }
+
+// adminRoutes adds the admin pages: the page itself (signed-in Gitea admins only), the login, and
+// the API it calls.
+func adminRoutes(mux *http.ServeMux, au *auth, adm *adminAPI) {
+	page, _ := webFiles.ReadFile("web/admin.html")
+	mux.HandleFunc("GET /admin", func(w http.ResponseWriter, r *http.Request) {
+		if _, err := au.user(r); err != nil {
+			http.Redirect(w, r, "/admin/login", http.StatusFound)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Write(page)
+	})
+	mux.HandleFunc("GET /admin/login", au.login)
+	mux.HandleFunc("GET /admin/callback", au.callback)
+	mux.HandleFunc("POST /admin/logout", func(w http.ResponseWriter, r *http.Request) {
+		if !sameOrigin(r) {
+			http.Error(w, "cross-site request refused", http.StatusForbidden)
+			return
+		}
+		au.logout(w, r)
+	})
+	adm.routes(mux, au)
+}