feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
  calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
  history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
  from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
  stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3

tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0/app/api/admin/login/route.ts

@@ -0,0 +1,36 @@
+import {
+  clearLoginFailures,
+  clientIp,
+  isAdminNetworkAllowed,
+  json,
+  loginLockedFor,
+  readJsonBody,
+  recordLoginFailure,
+  sameOrigin,
+  sessionCookie,
+  verifyPassword,
+} from "../../../_lib/auth";
+import { readAuth } from "../../../_lib/store";
+
+export const dynamic = "force-dynamic";
+
+export async function POST(request: Request) {
+  if (!isAdminNetworkAllowed(request.headers)) return json({ error: "Admin is only available on the home network." }, 403);
+  if (!sameOrigin(request)) return json({ error: "Cross-origin request refused." }, 403);
+  const ip = clientIp(request.headers);
+  const locked = loginLockedFor(ip);
+  if (locked) return json({ error: `Too many attempts. Try again in ${locked} seconds.` }, 429);
+
+  const auth = await readAuth();
+  if (!auth.passwordHash) return json({ error: "No password is set yet." }, 409);
+  const body = await readJsonBody<{ password?: string }>(request);
+  const password = typeof body?.password === "string" ? body.password : "";
+  if (!password || !(await verifyPassword(password, auth.passwordHash))) {
+    recordLoginFailure(ip);
+    console.warn(`[admin] failed login from ${ip}`);
+    return json({ error: "Wrong password." }, 401);
+  }
+  clearLoginFailures(ip);
+  console.log(`[admin] login from ${ip}`);
+  return json({ ok: true }, 200, { "Set-Cookie": sessionCookie(auth.sessionSecret) });
+}