Add admin login

- admins and login_attempts tables
- cli/create_admin.php: create an admin or reset a password over SSH
  (no email involved)
- includes/auth.php: hardened admin sessions, login throttling (5
  failures per IP per 15 minutes) and CSRF helpers
- admin/: login, logout and a dashboard showing broadcast status
- includes/admin_layout.php: shared admin page layout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cli/create_admin.php

@@ -0,0 +1,54 @@
+<?php
+// Creates an admin account, or resets the password if the username already exists:
+//   php cli/create_admin.php <username>
+// The password is prompted for and never echoed or passed on the command line.
+
+if (PHP_SAPI !== 'cli') {
+    http_response_code(403);
+    exit;
+}
+
+require __DIR__ . '/../includes/db.php';
+
+const MIN_PASSWORD_LENGTH = 12;
+
+function promptHidden(string $prompt): string {
+    echo $prompt;
+    $interactive = function_exists('posix_isatty') && posix_isatty(STDIN);
+    if ($interactive) shell_exec('stty -echo');
+    $value = rtrim((string)fgets(STDIN), "\r\n");
+    if ($interactive) {
+        shell_exec('stty echo');
+        echo "\n";
+    }
+    return $value;
+}
+
+$username = $argv[1] ?? '';
+if (!preg_match('/^[A-Za-z0-9_.-]{1,64}$/', $username)) {
+    fwrite(STDERR, "Usage: php cli/create_admin.php <username>\n(letters, numbers, dot, dash and underscore only)\n");
+    exit(1);
+}
+
+$password = promptHidden('Password: ');
+if (strlen($password) < MIN_PASSWORD_LENGTH) {
+    fwrite(STDERR, 'Password must be at least ' . MIN_PASSWORD_LENGTH . " characters.\n");
+    exit(1);
+}
+if (promptHidden('Confirm password: ') !== $password) {
+    fwrite(STDERR, "Passwords do not match.\n");
+    exit(1);
+}
+
+$db = getDB();
+$hash = password_hash($password, PASSWORD_DEFAULT);
+
+$stmt = $db->prepare('SELECT id FROM admins WHERE username = ?');
+$stmt->execute([$username]);
+if ($stmt->fetch()) {
+    $db->prepare('UPDATE admins SET password_hash = ? WHERE username = ?')->execute([$hash, $username]);
+    echo "Password reset for {$username}.\n";
+} else {
+    $db->prepare('INSERT INTO admins (username, password_hash) VALUES (?, ?)')->execute([$username, $hash]);
+    echo "Admin {$username} created.\n";
+}