Owner-only admin page: Reader roster plus Poll Lane status (#102) (#107)

Closes #102.

The only operational surface was /healthz and a fold-out roster inside the owner's own reading page. This adds /admin: an owner-only page carrying the Reader roster and one row per Poll Lane.

- **Poller seam.** `latest.Poller` records each Lane's last pass (`Site`, `Due`, `Checked`, `LastRun`, `Gap`, `Clamped`, `Browser`) and answers `LaneStatus()`; the page reads that snapshot, never a table. A pass that returns before computing its figures (refusal backoff, sidecar down) carries the previous pass's figures forward rather than recording zeroes, and a Lane that has never reached a pace renders no gap at all. Refusal and sidecar reachability are derived at snapshot time.
- **Owner gate at registration.** Every route reaching past the acting Reader lives in `adminRoutes()` and is wrapped in `requireOwner` when it is registered, so a missing gate is visible in the route list rather than hidden in a handler. `web.AdminPatterns()` is what the gate test walks, so a new route cannot be added without being tested. A non-owner gets 404, never 403.
- **Nil poller is a first-class state.** `main.newRouter` takes the reporter as an interface and converts a nil `*Poller` to a nil interface; no poller and no completed pass both render "No data yet" with the reason spelled out, rather than confident zeroes.
- **Roster moved** off the reading page onto /admin, with the Sighting counters and a confirm-gated `Clear marks` control. #103 fills those counters, so on delivery they read zero for everyone - deliberate ordering.
- **One accent, `--patina`** (verdigris, both colour branches): the far side of the wheel from ember's crimson and clear of the archive blue. Ember still means new chapter only; revocation still wears --danger.

Verification: `go vet ./...` and `go test ./...` green (Docker-backed); admin page screenshotted at 1100px and 390px in both colour schemes. Reviewed on both axes (spec, standards); findings on the accent hue, zero-figure honesty and three tests that could not fail are fixed in 58014eb.
Reviewed-on: #107
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/web/web.go

@@ -50,6 +50,9 @@ type Handler struct {
 	// httpClient is the plain stdlib client that talks to Discord. It is not
 	// an injected interface: tests point APIBase at a stub server instead.
 	httpClient *http.Client
+	// lanes is the Poll Lane snapshot source the administrative page reads.
+	// Nil is a running deployment with no poller, not a bug.
+	lanes LaneReporter
 }
 
 // listView is what every list-rendering template receives.
@@ -77,14 +80,9 @@ type listView struct {
 	// It is not "newly registered": a Reader who deletes their last bookmark is
 	// in the same position and needs the same links.
 	EmptyLibrary bool
-	// Owner marks the acting Reader as the deployment's owner, which unlocks
-	// the Readers panel. Nothing else in the UI differs.
+	// Owner marks the acting Reader as the deployment's owner, which offers
+	// the link to the administrative page. Nothing else in the UI differs.
 	Owner bool
-	// Readers is the owner's roster, populated only for the owner's own page
-	// render and the revocation fragment. OwnerID travels with it so the roster
-	// can tell the owner's own row apart from the Readers they may revoke.
-	Readers []store.ReaderSummary
-	OwnerID int64
 }
 
 // PageURL and ListURL are the two link shapes every tab needs. Building them
@@ -111,7 +109,10 @@ type loginView struct {
 
 // New parses every template up front so a broken one kills the process at
 // startup rather than the first request that touches it.
-func New(s *store.Store, discord DiscordConfig, tokenKey []byte, mangaPath, novelPath string) (*Handler, error) {
+//
+// lanes is the administrative page's window onto the running Poller; nil means
+// nothing is polling, which the page reports rather than hides.
+func New(s *store.Store, discord DiscordConfig, tokenKey []byte, mangaPath, novelPath string, lanes LaneReporter) (*Handler, error) {
 	tmpl, err := template.ParseFS(templateFS, "templates/*.html")
 	if err != nil {
 		return nil, err
@@ -126,6 +127,7 @@ func New(s *store.Store, discord DiscordConfig, tokenKey []byte, mangaPath, nove
 		states:              newOAuthStates(),
 		limiter:             session.NewLoginLimiter(),
 		httpClient:          &http.Client{Timeout: discordTimeout},
+		lanes:               lanes,
 	}, nil
 }
 
@@ -149,9 +151,11 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("GET /install/manga-bookmark.user.js", h.requireSession(h.installUserscript("manga-bookmark.user.js")))
 	mux.HandleFunc("GET /install/novel-bookmark.user.js", h.requireSession(h.installUserscript("novel-bookmark.user.js")))
 	mux.HandleFunc("POST /rotate-token", h.requireSession(h.rotateToken))
-
-	// Owner-only: the one place the UI crosses the Reader boundary.
-	mux.HandleFunc("POST /readers/{id}/revoke", h.requireSession(h.revokeReaderSessions))
+	// Owner-only: every route that reaches past the acting Reader is gated in
+	// one place, so a missing gate is visible in the route list.
+	for _, rt := range h.adminRoutes() {
+		mux.HandleFunc(rt.pattern, h.requireOwner(rt.handler))
+	}
 }
 
 // staticHandler serves the embedded assets. An hour, not longer: assets are
@@ -240,14 +244,9 @@ func (h *Handler) index(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	if readerID == h.store.OwnerID() {
-		view.Owner, view.OwnerID = true, readerID
-		if view.Readers, err = h.store.Readers(); err != nil {
-			log.Printf("index readers: %v", err)
-			http.Error(w, "internal error", http.StatusInternalServerError)
-			return
-		}
-	}
+	// The owner's page differs only by the link to the administrative page:
+	// the roster lives there now, so the page read every day is only reading.
+	view.Owner = readerID == h.store.OwnerID()
 	h.render(w, http.StatusOK, "app", view)
 }
 
@@ -618,40 +617,3 @@ func (h *Handler) rotateToken(w http.ResponseWriter, r *http.Request) {
 	view := listView{Lib: store.KindManga, Rotated: true}
 	h.render(w, http.StatusOK, "setup", view)
 }
-
-// revokeReaderSessions logs one Reader out of every browser they are signed
-// in on. Owner-only: it reaches across the Reader boundary every other handler
-// respects, so the guard is a comparison against the seeded owner rather than
-// a role a Reader could acquire. A non-owner gets 404 — the panel does not
-// exist for them, so neither should the endpoint.
-func (h *Handler) revokeReaderSessions(w http.ResponseWriter, r *http.Request) {
-	if readerOf(r) != h.store.OwnerID() {
-		http.NotFound(w, r)
-		return
-	}
-	target, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
-	if err != nil {
-		http.Error(w, "bad reader id", http.StatusBadRequest)
-		return
-	}
-	// The owner is not one of the Readers this endpoint reaches: revoking
-	// themselves would sign out the browser making the request, which is what
-	// logout is for. The roster hides the button; this refuses the hand-rolled
-	// POST behind it.
-	if target == h.store.OwnerID() {
-		http.NotFound(w, r)
-		return
-	}
-	if err := h.store.DeleteReaderSessions(target); err != nil {
-		log.Printf("revoke sessions: %v", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	readers, err := h.store.Readers()
-	if err != nil {
-		log.Printf("revoke sessions: %v", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	h.render(w, http.StatusOK, "readers", listView{Owner: true, Readers: readers, OwnerID: h.store.OwnerID()})
-}