feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
  calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
  history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
  from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
  stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3

tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0/app/api/health/route.ts

@@ -1,20 +1,24 @@
+import { readAuth, readSettings } from "../../_lib/store";
+
 export const dynamic = "force-dynamic";
 
 export async function GET() {
-  let calendarConfigurationValid = false;
+  const { calendars } = await readSettings();
+  let adminConfigured = false;
   try {
-    const parsed = JSON.parse(process.env.CALENDAR_ICAL_URLS || "[]") as unknown;
-    calendarConfigurationValid = Array.isArray(parsed) && parsed.length > 0;
+    adminConfigured = Boolean((await readAuth()).passwordHash);
   } catch {
-    calendarConfigurationValid = false;
+    adminConfigured = false;
   }
 
   return Response.json(
     {
       status: "ok",
       service: "hobbs-family-organizer",
-      version: "1.0.0",
-      calendarConfigurationValid,
+      version: "1.1.0",
+      calendarConfigurationValid: calendars.some((calendar) => calendar.enabled),
+      calendarsEnabled: calendars.filter((calendar) => calendar.enabled).length,
+      adminConfigured,
       authenticationEnabled: Boolean(process.env.ORGANIZER_ACCESS_TOKEN),
       checkedAt: new Date().toISOString(),
     },