Phase 2: SQLite persistence, admin setup-link, login/sessions

Implements the secure single-admin panel entry (spec 7.6).

- internal/store: modernc.org/sqlite (pure Go, static build), WAL +
  foreign keys, embedded PRAGMA user_version migrations; schema 0001
  covers admin/settings/domains/applications/send_log/rate_limits (spec 9).
- Setup secret-link (spec 7.6.1): 128-bit crypto/rand token, printed to
  log + /data/setup-token (0600), 10-min TTL with regeneration, per-IP
  rate limit, subtle.ConstantTimeCompare, failures don't invalidate,
  one-time admin form, permanent invalidation once admin exists (/setup 404).
- bcrypt admin password; server-side username/password validation.
- Login + in-memory sessions, crypto-random token, cookie
  HttpOnly/Secure/SameSite (Secure toggleable for dev HTTP), login
  rate limit, auth middleware.
- html/template base layout + setup/login/dashboard, vendored htmx 2.0.4.
- build/entrypoint.sh: fix bind-mounted /data ownership as root before
  supervisord drops to the unprivileged panel user (found via container test).

Verified on selfpost.example.com: go vet/build/test/gofmt clean; e2e curl
of setup+login flows; docker build + run with -v ./data:/data creates the
DB and 0600 token owned by panel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/handlers_setup.go

@@ -0,0 +1,98 @@
+package web
+
+import (
+	"net/http"
+	"strings"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// handleSetup serves the one-time administrator creation flow at
+// /setup/<token> (spec 7.6.1). Once an administrator exists the whole route
+// returns 404; an invalid or expired token is indistinguishable from a missing
+// page, also 404.
+func (s *Server) handleSetup(w http.ResponseWriter, r *http.Request) {
+	// Route-specific rate limit, separate from login (spec 7.6.1).
+	if !s.setupLimiter.Allow(clientIP(r)) {
+		http.Error(w, "too many requests", http.StatusTooManyRequests)
+		return
+	}
+
+	token := strings.TrimPrefix(r.URL.Path, "/setup/")
+	// Reject nested/garbage paths outright.
+	if token == "" || strings.Contains(token, "/") {
+		http.NotFound(w, r)
+		return
+	}
+	if !s.setup.validate(token) {
+		http.NotFound(w, r)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		s.renderSetupForm(w, http.StatusOK, token, "")
+	case http.MethodPost:
+		s.submitSetup(w, r, token)
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+func (s *Server) renderSetupForm(w http.ResponseWriter, status int, token, formErr string) {
+	s.render(w, status, "setup", map[string]any{
+		"Title": "SelfPost — Create administrator",
+		"Token": token,
+		"Error": formErr,
+	})
+}
+
+func (s *Server) submitSetup(w http.ResponseWriter, r *http.Request, token string) {
+	if err := r.ParseForm(); err != nil {
+		s.renderSetupForm(w, http.StatusBadRequest, token, "Invalid form submission.")
+		return
+	}
+	username := strings.TrimSpace(r.PostFormValue("username"))
+	password := r.PostFormValue("password")
+	confirm := r.PostFormValue("password_confirm")
+
+	if err := validateUsername(username); err != nil {
+		s.renderSetupForm(w, http.StatusBadRequest, token, err.Error())
+		return
+	}
+	if password != confirm {
+		s.renderSetupForm(w, http.StatusBadRequest, token, "Passwords do not match.")
+		return
+	}
+	if err := validateAdminPassword(password); err != nil {
+		s.renderSetupForm(w, http.StatusBadRequest, token, err.Error())
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		logf("panel: setup: hashing password failed: %v", err)
+		s.renderSetupForm(w, http.StatusInternalServerError, token, "Internal error. Please try again.")
+		return
+	}
+
+	if err := s.store.CreateAdmin(username, string(hash)); err != nil {
+		// A concurrent submission may have already created the admin; the
+		// id=1 / non-empty-table guard makes this the second writer. Treat it
+		// as "setup already done" rather than an error.
+		if exists, _ := s.store.AdminExists(); exists {
+			s.setup.complete()
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		logf("panel: setup: create admin failed: %v", err)
+		s.renderSetupForm(w, http.StatusInternalServerError, token, "Internal error. Please try again.")
+		return
+	}
+
+	// Setup is now permanently complete: burn the token (spec 7.6.1).
+	s.setup.complete()
+	logf("panel: administrator %q created; setup link is now disabled", username)
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}