feat: resolve all 22 items in Features and Bugs.txt and complete UI polish

server/src/auth.ts

@@ -178,4 +178,34 @@ export function registerAuthRoutes(app: FastifyInstance): void {
     requireAuth(req);
     return { user: req.user };
   });
+
+  // Bootstrap or sign into the local admin account when no admin session is active yet.
+  app.post("/api/auth/bootstrap-admin", async (_req, reply) => {
+    const db = app.db;
+    let adminRow = db
+      .prepare("SELECT * FROM users WHERE role = 'admin' AND disabled = 0 ORDER BY created_at ASC LIMIT 1")
+      .get() as UserRow | undefined;
+
+    if (!adminRow) {
+      const id = ulid();
+      const now = new Date().toISOString();
+      const email = process.env.PUBSCRIPT_ADMIN_EMAIL ?? "admin@pubscript.local";
+      const password = process.env.PUBSCRIPT_ADMIN_PASSWORD ?? "admin12345";
+      const passHash = await hashPassword(password);
+      db.prepare(
+        "INSERT INTO users (id, email, pass_hash, display_name, role, disabled, created_at) VALUES (?, ?, ?, ?, 'admin', 0, ?)",
+      ).run(id, email, passHash, "Local Admin", now);
+      db.prepare("INSERT INTO audit (id, at, user_id, action, detail) VALUES (?, ?, ?, 'admin.bootstrap', ?)").run(
+        ulid(),
+        now,
+        id,
+        JSON.stringify({ email }),
+      );
+      adminRow = db.prepare("SELECT * FROM users WHERE id = ?").get(id) as UserRow;
+    }
+
+    const token = createSession(db, adminRow.id);
+    setSessionCookie(reply, token);
+    return { token, user: toUser(adminRow) };
+  });
 }