Phase 2: SQLite persistence, admin setup-link, login/sessions

Implements the secure single-admin panel entry (spec 7.6).

- internal/store: modernc.org/sqlite (pure Go, static build), WAL +
  foreign keys, embedded PRAGMA user_version migrations; schema 0001
  covers admin/settings/domains/applications/send_log/rate_limits (spec 9).
- Setup secret-link (spec 7.6.1): 128-bit crypto/rand token, printed to
  log + /data/setup-token (0600), 10-min TTL with regeneration, per-IP
  rate limit, subtle.ConstantTimeCompare, failures don't invalidate,
  one-time admin form, permanent invalidation once admin exists (/setup 404).
- bcrypt admin password; server-side username/password validation.
- Login + in-memory sessions, crypto-random token, cookie
  HttpOnly/Secure/SameSite (Secure toggleable for dev HTTP), login
  rate limit, auth middleware.
- html/template base layout + setup/login/dashboard, vendored htmx 2.0.4.
- build/entrypoint.sh: fix bind-mounted /data ownership as root before
  supervisord drops to the unprivileged panel user (found via container test).

Verified on selfpost.mixfed.ru: go vet/build/test/gofmt clean; e2e curl
of setup+login flows; docker build + run with -v ./data:/data creates the
DB and 0600 token owned by panel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/session.go

@@ -0,0 +1,62 @@
+package web
+
+import (
+	"sync"
+	"time"
+)
+
+// sessionTTL bounds how long a login lasts before re-authentication is needed.
+const sessionTTL = 12 * time.Hour
+
+// sessionStore keeps active sessions in memory. Sessions are deliberately not
+// persisted (spec 9 lists what must survive restart; sessions are not on it):
+// a restart simply logs the admin out, which is acceptable and avoids storing
+// bearer tokens on disk. Tokens are crypto-random (spec 7.6.6).
+type sessionStore struct {
+	mu       sync.Mutex
+	sessions map[string]session
+}
+
+type session struct {
+	username  string
+	expiresAt time.Time
+}
+
+func newSessionStore() *sessionStore {
+	return &sessionStore{sessions: make(map[string]session)}
+}
+
+// Create issues a new session for username and returns its token.
+func (s *sessionStore) Create(username string) string {
+	token := randomToken(32)
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.sessions[token] = session{username: username, expiresAt: time.Now().Add(sessionTTL)}
+	return token
+}
+
+// Lookup returns the session username for a token if it exists and is unexpired.
+func (s *sessionStore) Lookup(token string) (string, bool) {
+	if token == "" {
+		return "", false
+	}
+	now := time.Now()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	sess, ok := s.sessions[token]
+	if !ok {
+		return "", false
+	}
+	if now.After(sess.expiresAt) {
+		delete(s.sessions, token)
+		return "", false
+	}
+	return sess.username, true
+}
+
+// Destroy invalidates a session token (logout).
+func (s *sessionStore) Destroy(token string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.sessions, token)
+}