Refactor admin panel: enhance user management and security features

- Added role-based access control for user management links in admin navigation.
- Improved user account display with a dedicated account link.
- Implemented form submission confirmation for delete actions in the admin interface.
- Introduced a password visibility toggle on the login page.
- Added login throttling to prevent brute-force attacks, recording failed attempts.
- Created a CLI script for creating an admin user, replacing the previous hardcoded admin credentials.
- Updated database schema to support login attempt tracking.
- Enhanced user editing functionality, allowing role changes with restrictions.
- Improved modal handling for user actions, ensuring better focus management.
- Added styles for new account management page and improved modal transitions.

inc/login-throttle.php

@@ -0,0 +1,82 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Login brute-force throttle.
+ *
+ * Failed logins are recorded per client IP and per username. If either
+ * passes its limit inside the window, further attempts are refused until
+ * enough failures age out. A successful login clears that IP + username's
+ * failures.
+ */
+
+require_once __DIR__ . '/db.php';
+
+const LOGIN_WINDOW_SECONDS = 900; // 15 minutes
+const LOGIN_MAX_PER_IP = 5;
+const LOGIN_MAX_PER_USERNAME = 10;
+
+/**
+ * The real client IP. Behind a reverse proxy (NPM or Caddy), REMOTE_ADDR
+ * is the proxy's Docker-network address, so X-Forwarded-For is trusted —
+ * but only when the request came from a private or loopback address (the
+ * proxy), never from a public address that could set the header itself.
+ *
+ * The rightmost entry is used because it's the one our proxy appended.
+ * NPM appends to any value the client sent, so leftmost entries can be
+ * forged; Caddy discards the client's value, so it's the only entry.
+ */
+function client_ip(): string {
+	$remote = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+	$isPublic = filter_var($remote, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
+	if (!$isPublic) {
+		$chain = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '');
+		$forwarded = trim(end($chain));
+		if (filter_var($forwarded, FILTER_VALIDATE_IP) !== false) {
+			return $forwarded;
+		}
+	}
+	return $remote;
+}
+
+/**
+ * Seconds until this IP / username may try again, or 0 if not locked.
+ * Locked means the Nth most recent failure (N = the limit) is still
+ * inside the window; the lock lifts when that failure ages out.
+ */
+function login_lock_seconds(string $ip, string $username): int {
+	$pdo = get_db();
+	$since = time() - LOGIN_WINDOW_SECONDS;
+	$checks = [
+		['ip', $ip, LOGIN_MAX_PER_IP],
+		['username', $username, LOGIN_MAX_PER_USERNAME],
+	];
+	$wait = 0;
+	foreach ($checks as [$column, $value, $max]) {
+		$stmt = $pdo->prepare(
+			"SELECT attempted_at FROM login_attempts
+			WHERE $column = ? AND attempted_at > ?
+			ORDER BY attempted_at DESC LIMIT 1 OFFSET ?"
+		);
+		$stmt->execute([$value, $since, $max - 1]);
+		$nth = $stmt->fetchColumn();
+		if ($nth !== false) {
+			$wait = max($wait, (int) $nth + LOGIN_WINDOW_SECONDS - time());
+		}
+	}
+	return $wait;
+}
+
+function record_login_failure(string $ip, string $username): void {
+	$pdo = get_db();
+	$pdo->prepare("INSERT INTO login_attempts (ip, username, attempted_at) VALUES (?, ?, ?)")
+		->execute([$ip, $username, time()]);
+	// Prune anything outside the window so the table stays small.
+	$pdo->prepare("DELETE FROM login_attempts WHERE attempted_at <= ?")
+		->execute([time() - LOGIN_WINDOW_SECONDS]);
+}
+
+function clear_login_failures(string $ip, string $username): void {
+	get_db()->prepare("DELETE FROM login_attempts WHERE ip = ? AND username = ?")
+		->execute([$ip, $username]);
+}