Add SQLite-backed announcement system and admin portal

- Add SQLite database initialization and management in inc/db.php
- Implement session authentication and CSRF security helpers in inc/auth.php
- Implement announcement querying and saving in inc/announcements.php
- Add management dashboard, login, and logout in admin/
- Protect db/ directory with Apache access controls

inc/auth.php

@@ -0,0 +1,82 @@
+<?php
+/**
+ * Auth & session helper
+ */
+
+if (session_status() === PHP_SESSION_NONE) {
+    // Configure secure session cookie defaults
+    session_set_cookie_params([
+        'lifetime' => 86400 * 7, // 7 days
+        'path' => '/',
+        'httponly' => true,
+        'samesite' => 'Lax'
+    ]);
+    session_start();
+}
+
+require_once __DIR__ . '/db.php';
+
+function is_authenticated(): bool {
+    return !empty($_SESSION['admin_user_id']);
+}
+
+function require_auth(): void {
+    if (!is_authenticated()) {
+        header('Location: login.php');
+        exit;
+    }
+}
+
+function get_logged_in_user(): ?array {
+    if (!is_authenticated()) {
+        return null;
+    }
+    return [
+        'id' => $_SESSION['admin_user_id'],
+        'username' => $_SESSION['admin_username'] ?? 'admin',
+        'role' => $_SESSION['admin_role'] ?? 'admin'
+    ];
+}
+
+function authenticate_user(string $username, string $password): bool {
+    $pdo = get_db();
+    $stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
+    $stmt->execute([trim($username)]);
+    $user = $stmt->fetch();
+
+    if ($user && password_verify($password, $user['password_hash'])) {
+        session_regenerate_id(true);
+        $_SESSION['admin_user_id'] = $user['id'];
+        $_SESSION['admin_username'] = $user['username'];
+        $_SESSION['admin_role'] = $user['role'];
+        return true;
+    }
+
+    return false;
+}
+
+function logout_user(): void {
+    $_SESSION = [];
+    if (ini_get("session.use_cookies")) {
+        $params = session_get_cookie_params();
+        setcookie(session_name(), '', time() - 42000,
+            $params["path"], $params["domain"],
+            $params["secure"], $params["httponly"]
+        );
+    }
+    session_destroy();
+}
+
+function get_csrf_token(): string {
+    if (empty($_SESSION['csrf_token'])) {
+        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['csrf_token'];
+}
+
+function verify_csrf_token(?string $token): bool {
+    if (empty($_SESSION['csrf_token']) || empty($token)) {
+        return false;
+    }
+    return hash_equals($_SESSION['csrf_token'], $token);
+}