feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
  calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
  history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
  from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
  stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3

compose/hf-pdocker-02/hobbs-organizer/.env

@@ -19,3 +19,7 @@ NWS_FORECAST_URL=https://api.weather.gov/gridpoints/TSA/37,98/forecast
 # The National Weather Service asks clients to identify themselves. Replace
 # the example contact with an address monitored by the server operator.
 WEATHER_USER_AGENT="Hobbs-Family-Organizer/1.0 (self-hosted)"
+
+# Admin (v1.1.0)
+HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data
+ADMIN_ALLOWED_CIDRS=192.168.86.0/24,127.0.0.1/32