feat(hobbs-organizer): v1.1.0 password-protected LAN-only admin for calendar links

- /admin: first-visit password setup (scrypt), signed 30-day session cookie,
  calendars add/remove/reorder/rename/color/hide, masked URLs, per-feed test,
  history (20) with restore; /photo-admin -> /admin#photos placeholder
- settings in local /data (settings.json + auth.json + history/), seeded once
  from the calendar secret; dashboard + health read from settings
- start.mjs drops privileges after reading secrets and runs a front proxy that
  stamps the real client IP; admin refuses non-LAN and proxied requests
- deploy: HOBBS_DATA_DIR=/var/lib/hobbs-organizer/data, image 1.1.0 (1.0.0 kept)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E9NnVEico3WvFxLyjy1iW3

tv app/Hobbs-Family-Organizer-Self-Hosted-v1.0.0/proxy.ts

@@ -1,6 +1,7 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import type { NextRequest } from "next/server";
 import { NextResponse } from "next/server";
+import { isAdminNetworkAllowed } from "./app/_lib/auth";
 
 function tokenMatches(actual: string, expected: string) {
   const actualValue = createHash("sha256").update(actual).digest();
@@ -9,7 +10,22 @@ function tokenMatches(actual: string, expected: string) {
 }
 
 export function proxy(request: NextRequest) {
-  if (request.nextUrl.pathname === "/api/health") return NextResponse.next();
+  const { pathname } = request.nextUrl;
+  if (pathname === "/api/health") return NextResponse.next();
+
+  // Admin has its own password + session and is reachable only from a direct LAN connection.
+  if (pathname === "/admin" || pathname.startsWith("/admin/") || pathname.startsWith("/api/admin/") || pathname === "/photo-admin") {
+    if (!isAdminNetworkAllowed(request.headers)) {
+      return new NextResponse("Not found", { status: 404, headers: { "Cache-Control": "no-store" } });
+    }
+    if (pathname === "/photo-admin") {
+      const target = new URL("/admin", request.url);
+      target.host = request.headers.get("host") || target.host;
+      target.hash = "photos";
+      return NextResponse.redirect(target, 307);
+    }
+    return NextResponse.next();
+  }
 
   const configuredToken = process.env.ORGANIZER_ACCESS_TOKEN?.trim();
   if (!configuredToken) return NextResponse.next();