feat(manager-core): admin auth gate (Phase 3a)

Closes the regression risk of the admin API and dashboard being open
to anyone reaching the bound port. Required foundation before v1.1
data-plane services land.

Per-user accounts (admin_users), Argon2id passwords, env-var bootstrap
of the first admin that becomes inert once any admin exists, opaque
32-byte session token doubling as bearer credential, 24h sliding TTL
configurable via PICLOUD_SESSION_TTL_HOURS. is_active column lets
admins be deactivated without losing audit history; last-active-admin
guard on DELETE and on PATCH that flips is_active to false (sessions
also wiped on deactivation).

require_admin middleware fronts every /api/v1/admin/* route. The data
plane (/api/v1/execute/{id}), /healthz, /version, and user routes
stay open. picloud admin reset-password <username> subcommand handles
recovery without going through HTTP.

Dashboard gains /admin/login and /admin/admins surfaces, a top-bar
user menu, and a token store with a localStorage echo so refreshes
don't sign you out. Cookie-based auth works in parallel for non-SPA
clients.

Forward compatibility: future RBAC tables (admin_roles,
admin_user_roles) join on admin_users.id; the auth middleware is the
seam where role checks slot in. Email, 2FA, passkeys, and personal
API tokens are all additive without touching admin_users.

Blueprint §11.4 updated to reflect what actually shipped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud/tests/api.rs

@@ -17,9 +17,35 @@ use axum_test::TestServer;
 use serde_json::{json, Value};
 use sqlx::PgPool;
 
+/// Build the all-in-one app over the test pool, seed a single admin
+/// directly through the repo (bypassing the env-var bootstrap path so
+/// tests don't contaminate the process environment), log in, and bake
+/// the bearer token into the TestServer as a default header so every
+/// request in the test passes the `require_admin` middleware.
 async fn server(pool: PgPool) -> TestServer {
-    let app = picloud::build_app(pool).await.expect("build_app");
-    TestServer::new(app).expect("TestServer should build")
+    use picloud_manager_core::auth::hash_password;
+
+    let auth = picloud::AuthDeps::from_pool(pool.clone());
+    let hash = hash_password("test-pw").expect("hash");
+    auth.users
+        .create("test-admin", &hash)
+        .await
+        .expect("seed admin");
+
+    let app = picloud::build_app(pool, auth).await.expect("build_app");
+    let mut server = TestServer::new(app).expect("TestServer should build");
+
+    let resp = server
+        .post("/api/v1/admin/auth/login")
+        .json(&json!({ "username": "test-admin", "password": "test-pw" }))
+        .await;
+    resp.assert_status_ok();
+    let token = resp.json::<Value>()["token"]
+        .as_str()
+        .expect("login should return token")
+        .to_string();
+    server.add_header("authorization", format!("Bearer {token}"));
+    server
 }
 
 // ============================================================================
@@ -705,7 +731,7 @@ async fn version_includes_public_base_url(pool: PgPool) {
     let v: Value = r.json();
     assert!(v["public_base_url"].is_string());
     assert_eq!(v["api"], 1);
-    assert_eq!(v["schema"], 3);
+    assert_eq!(v["schema"], 4);
     assert_eq!(v["sdk"], "1.1");
 }