feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
  calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
  history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
  from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
  stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3

tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0/compose.yaml

@@ -2,7 +2,7 @@ name: hobbs-family-organizer
 
 services:
   organizer:
-    image: hobbs-family-organizer:1.0.0
+    image: hobbs-family-organizer:1.1.0
     build:
       context: .
       dockerfile: Dockerfile
@@ -21,11 +21,17 @@ services:
       WEATHER_USER_AGENT: ${WEATHER_USER_AGENT:-Hobbs-Family-Organizer/1.0 (self-hosted)}
       CALENDAR_ICAL_URLS_FILE: /run/secrets/calendar_ical_urls
       ORGANIZER_ACCESS_TOKEN_FILE: /run/secrets/organizer_access_token
+      ORGANIZER_DATA_DIR: /data
+      ADMIN_ALLOWED_CIDRS: ${ADMIN_ALLOWED_CIDRS:-192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,127.0.0.1/32}
     secrets:
       - calendar_ical_urls
       - organizer_access_token
     ports:
       - "${HOBBS_BIND_ADDRESS:-0.0.0.0}:${HOBBS_HTTP_PORT:-8080}:3000"
+    volumes:
+      # Admin settings, password hash and history. Must be writable by uid 10001,
+      # and must be local disk (not NFS with root_squash).
+      - ${HOBBS_DATA_DIR:-./data}:/data
     read_only: true
     tmpfs:
       - /tmp:size=64m,mode=1777