feat: add admin panel with user, tag, and signup management

Phase 4 — Admin Panel:
- Admin dashboard with user/fave/pending-request counts
- User management: create with temp password, reset password,
  enable/disable accounts (prevents self-disable)
- Tag management: rename and delete tags
- Signup request management: approve (creates user with
  must-reset-password) and reject pending requests
- Site settings: site name, description, signup mode
  (open/requests/closed)
- All admin routes require both login and admin role
- SignupRequest model and full store (create, list pending,
  approve with user creation, reject)
- SetMustResetPassword method on UserStore for admin password resets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/static/css/style.css

@@ -169,6 +169,25 @@
     border-radius: var(--pico-border-radius);
 }
 
+/* Admin */
+.stat {
+    font-size: 2rem;
+    font-weight: bold;
+    margin: 0;
+}
+
+.disabled-row {
+    opacity: 0.5;
+}
+
+.inline-input {
+    display: inline-block;
+    width: auto;
+    margin: 0;
+    padding: 0.25rem 0.5rem;
+    font-size: 0.875rem;
+}
+
 /* Respect reduced motion preference */
 @media (prefers-reduced-motion: reduce) {
     *, *::before, *::after {

web/templates/pages/admin_dashboard.html

@@ -0,0 +1,41 @@
+{{define "head"}}
+<meta name="robots" content="noindex">
+{{end}}
+
+{{define "content"}}
+<h1>Administrasjon</h1>
+
+{{with .Data}}
+<div class="grid">
+    <article>
+        <header><strong>Brukere</strong></header>
+        <p class="stat">{{.UserCount}}</p>
+        <footer><a href="{{basePath}}/admin/users">Administrer brukere</a></footer>
+    </article>
+    <article>
+        <header><strong>Favoritter</strong></header>
+        <p class="stat">{{.FaveCount}}</p>
+    </article>
+    <article>
+        <header><strong>Ventende forespørsler</strong></header>
+        <p class="stat">{{.PendingCount}}</p>
+        {{if gt .PendingCount 0}}
+            <footer><a href="{{basePath}}/admin/signup-requests">Se forespørsler</a></footer>
+        {{end}}
+    </article>
+</div>
+
+<nav>
+    <ul>
+        <li><a href="{{basePath}}/admin/users" role="button" class="outline">Brukere</a></li>
+        <li><a href="{{basePath}}/admin/tags" role="button" class="outline">Merkelapper</a></li>
+        <li><a href="{{basePath}}/admin/signup-requests" role="button" class="outline">Forespørsler</a></li>
+        <li><a href="{{basePath}}/admin/settings" role="button" class="outline">Innstillinger</a></li>
+    </ul>
+</nav>
+
+{{with .Settings}}
+    <p><small>Registreringsmodus: <strong>{{.SignupMode}}</strong></small></p>
+{{end}}
+{{end}}
+{{end}}

web/templates/pages/admin_requests.html

@@ -0,0 +1,44 @@
+{{define "head"}}
+<meta name="robots" content="noindex">
+{{end}}
+
+{{define "content"}}
+<h1>Registreringsforespørsler</h1>
+
+{{with .Data}}
+    {{if .Requests}}
+        <table role="grid">
+            <thead>
+                <tr>
+                    <th scope="col">Brukernavn</th>
+                    <th scope="col">Sendt</th>
+                    <th scope="col">Handlinger</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{range .Requests}}
+                <tr>
+                    <td>{{.Username}}</td>
+                    <td>{{.CreatedAt.Format "02.01.2006 15:04"}}</td>
+                    <td>
+                        <form method="POST" action="{{basePath}}/admin/signup-requests/{{.ID}}" class="inline-form">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <input type="hidden" name="action" value="approve">
+                            <button type="submit" class="outline primary nav-button">Godkjenn</button>
+                        </form>
+                        <form method="POST" action="{{basePath}}/admin/signup-requests/{{.ID}}" class="inline-form">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <input type="hidden" name="action" value="reject">
+                            <button type="submit" class="outline secondary nav-button"
+                                    onclick="return confirm('Avvis forespørselen fra «{{.Username}}»?')">Avvis</button>
+                        </form>
+                    </td>
+                </tr>
+                {{end}}
+            </tbody>
+        </table>
+    {{else}}
+        <p>Ingen ventende forespørsler.</p>
+    {{end}}
+{{end}}
+{{end}}

web/templates/pages/admin_settings.html

@@ -0,0 +1,48 @@
+{{define "head"}}
+<meta name="robots" content="noindex">
+{{end}}
+
+{{define "content"}}
+<h1>Nettstedsinnstillinger</h1>
+
+{{with .Data}}{{with .Settings}}
+<article>
+    <form method="POST" action="{{basePath}}/admin/settings">
+        <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+
+        <label for="site_name">
+            Nettstedsnavn
+            <input type="text" id="site_name" name="site_name"
+                   value="{{.SiteName}}" required>
+        </label>
+
+        <label for="site_description">
+            Beskrivelse
+            <textarea id="site_description" name="site_description"
+                      rows="3">{{.SiteDescription}}</textarea>
+        </label>
+
+        <fieldset>
+            <legend>Registreringsmodus</legend>
+            <label>
+                <input type="radio" name="signup_mode" value="open"
+                       {{if eq .SignupMode "open"}}checked{{end}}>
+                Åpen — alle kan registrere seg
+            </label>
+            <label>
+                <input type="radio" name="signup_mode" value="requests"
+                       {{if eq .SignupMode "requests"}}checked{{end}}>
+                Forespørsler — nye brukere må godkjennes
+            </label>
+            <label>
+                <input type="radio" name="signup_mode" value="closed"
+                       {{if eq .SignupMode "closed"}}checked{{end}}>
+                Stengt — ingen nye registreringer
+            </label>
+        </fieldset>
+
+        <button type="submit">Lagre innstillinger</button>
+    </form>
+</article>
+{{end}}{{end}}
+{{end}}

web/templates/pages/admin_tags.html

@@ -0,0 +1,42 @@
+{{define "head"}}
+<meta name="robots" content="noindex">
+{{end}}
+
+{{define "content"}}
+<h1>Merkelapper</h1>
+
+{{with .Data}}
+    {{if .Tags}}
+        <table role="grid">
+            <thead>
+                <tr>
+                    <th scope="col">Navn</th>
+                    <th scope="col">Handlinger</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{range .Tags}}
+                <tr>
+                    <td><a href="{{basePath}}/tags/{{.Name}}">{{.Name}}</a></td>
+                    <td>
+                        <form method="POST" action="{{basePath}}/admin/tags/{{.ID}}/rename" class="inline-form">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <input type="text" name="name" value="{{.Name}}" required
+                                   class="inline-input" aria-label="Nytt navn for merkelapp">
+                            <button type="submit" class="outline nav-button">Omdøp</button>
+                        </form>
+                        <form method="POST" action="{{basePath}}/admin/tags/{{.ID}}/delete" class="inline-form">
+                            <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                            <button type="submit" class="outline secondary nav-button"
+                                    onclick="return confirm('Slett merkelappen «{{.Name}}»?')">Slett</button>
+                        </form>
+                    </td>
+                </tr>
+                {{end}}
+            </tbody>
+        </table>
+    {{else}}
+        <p>Ingen merkelapper ennå.</p>
+    {{end}}
+{{end}}
+{{end}}

web/templates/pages/admin_users.html

@@ -0,0 +1,72 @@
+{{define "head"}}
+<meta name="robots" content="noindex">
+{{end}}
+
+{{define "content"}}
+<h1>Brukere</h1>
+
+<article>
+    <h2>Opprett ny bruker</h2>
+    <form method="POST" action="{{basePath}}/admin/users">
+        <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+        <div class="grid">
+            <label for="username">
+                Brukernavn
+                <input type="text" id="username" name="username" required
+                       pattern="[a-zA-Z0-9_-]+" minlength="2" maxlength="30">
+            </label>
+            <label for="role">
+                Rolle
+                <select id="role" name="role">
+                    <option value="user">Bruker</option>
+                    <option value="admin">Administrator</option>
+                </select>
+            </label>
+        </div>
+        <button type="submit">Opprett bruker</button>
+        <small>Brukeren vil få et midlertidig passord og må endre det ved første innlogging.</small>
+    </form>
+</article>
+
+{{with .Data}}
+<table role="grid">
+    <thead>
+        <tr>
+            <th scope="col">Brukernavn</th>
+            <th scope="col">Visningsnavn</th>
+            <th scope="col">Rolle</th>
+            <th scope="col">Status</th>
+            <th scope="col">Opprettet</th>
+            <th scope="col">Handlinger</th>
+        </tr>
+    </thead>
+    <tbody>
+        {{range .Users}}
+        <tr {{if .Disabled}}class="disabled-row"{{end}}>
+            <td><a href="{{basePath}}/u/{{.Username}}">{{.Username}}</a></td>
+            <td>{{.DisplayName}}</td>
+            <td>{{.Role}}</td>
+            <td>
+                {{if .Disabled}}Deaktivert
+                {{else if .MustResetPassword}}Må endre passord
+                {{else}}Aktiv{{end}}
+            </td>
+            <td>{{.CreatedAt.Format "02.01.2006"}}</td>
+            <td>
+                <form method="POST" action="{{basePath}}/admin/users/{{.ID}}/reset-password" class="inline-form">
+                    <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                    <button type="submit" class="outline secondary nav-button">Tilbakestill passord</button>
+                </form>
+                <form method="POST" action="{{basePath}}/admin/users/{{.ID}}/toggle-disabled" class="inline-form">
+                    <input type="hidden" name="csrf_token" value="{{$.CSRFToken}}">
+                    <button type="submit" class="outline {{if .Disabled}}primary{{else}}secondary{{end}} nav-button">
+                        {{if .Disabled}}Aktiver{{else}}Deaktiver{{end}}
+                    </button>
+                </form>
+            </td>
+        </tr>
+        {{end}}
+    </tbody>
+</table>
+{{end}}
+{{end}}