Refactor admin panel: enhance user management and security features

- Added role-based access control for user management links in admin navigation.
- Improved user account display with a dedicated account link.
- Implemented form submission confirmation for delete actions in the admin interface.
- Introduced a password visibility toggle on the login page.
- Added login throttling to prevent brute-force attacks, recording failed attempts.
- Created a CLI script for creating an admin user, replacing the previous hardcoded admin credentials.
- Updated database schema to support login attempt tracking.
- Enhanced user editing functionality, allowing role changes with restrictions.
- Improved modal handling for user actions, ensuring better focus management.
- Added styles for new account management page and improved modal transitions.

inc/auth.php

@@ -3,11 +3,30 @@
  * Auth & session helper
  */
 
+/**
+ * Whether the visitor reached us over HTTPS. TLS ends at the reverse proxy
+ * (NPM or Caddy), so PHP itself only ever sees plain HTTP — trust the
+ * proxy's X-Forwarded-Proto, but only from a private/loopback address so a
+ * public client can't claim it.
+ */
+function request_is_https(): bool {
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
+        return true;
+    }
+    $remote = $_SERVER['REMOTE_ADDR'] ?? '';
+    $fromProxy = filter_var($remote, FILTER_VALIDATE_IP)
+        && !filter_var($remote, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
+    return $fromProxy && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https';
+}
+
 if (session_status() === PHP_SESSION_NONE) {
-    // Configure secure session cookie defaults
+    // Configure secure session cookie defaults. 'secure' follows the
+    // request scheme so local dev over plain HTTP (including the phone on
+    // the LAN) can still log in; in production it's always HTTPS.
     session_set_cookie_params([
         'lifetime' => 86400 * 7, // 7 days
         'path' => '/',
+        'secure' => request_is_https(),
         'httponly' => true,
         'samesite' => 'Lax'
     ]);
@@ -26,18 +45,31 @@ function require_auth(): void {
         exit;
     }
 
-    // A user disabled mid-session should lose access immediately rather
-    // than keep it until their session expires — re-check against the DB
-    // instead of trusting the session's now-possibly-stale copy.
+    // A user disabled or re-roled mid-session should be affected
+    // immediately rather than when their session expires — re-check against
+    // the DB instead of trusting the session's now-possibly-stale copy.
     $pdo = get_db();
-    $stmt = $pdo->prepare("SELECT is_enabled FROM users WHERE id = ?");
+    $stmt = $pdo->prepare("SELECT is_enabled, role FROM users WHERE id = ?");
     $stmt->execute([$_SESSION['admin_user_id']]);
-    $stillEnabled = $stmt->fetchColumn();
-    if ($stillEnabled === false || (int) $stillEnabled !== 1) {
+    $row = $stmt->fetch();
+    if ($row === false || (int) $row['is_enabled'] !== 1) {
         logout_user();
         header('Location: login.php');
         exit;
     }
+    $_SESSION['admin_role'] = $row['role'];
+}
+
+/**
+ * Like require_auth(), but also requires a specific role. Checked against
+ * the role require_auth() just re-read from the DB, not the login-time copy.
+ */
+function require_role(string $role): void {
+    require_auth();
+    if (($_SESSION['admin_role'] ?? '') !== $role) {
+        http_response_code(403);
+        exit('Forbidden');
+    }
 }
 
 function get_logged_in_user(): ?array {