feat: implement user authentication and admin management

- Add user management API endpoints for listing and creating users.
- Implement login and logout functionality with rate limiting.
- Create UI components for login form, logout button, and animated elements.
- Add session management with JWT and secure cookie handling.
- Seed initial admin user if no users exist.
- Introduce utility functions for password hashing and user authentication.
- Set up proxy middleware for route protection and security headers.
- Create a JSON file for user data storage.
- Add links configuration for external resources.

frontend/app/api/admin/users/[id]/route.ts

@@ -0,0 +1,55 @@
+import { NextResponse } from 'next/server'
+import { deleteUser, updatePassword } from '@/lib/users'
+import { getSession } from '@/lib/session'
+
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const session = await getSession()
+  if (!session || session.role !== 'admin') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
+  const { id } = await params
+
+  // Prevent admins from deleting themselves
+  if (id === session.userId) {
+    return NextResponse.json({ error: 'You cannot delete your own account' }, { status: 400 })
+  }
+
+  try {
+    await deleteUser(id)
+    return NextResponse.json({ ok: true })
+  } catch (e) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 400 })
+  }
+}
+
+export async function PATCH(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const session = await getSession()
+  if (!session || session.role !== 'admin') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
+  const { id } = await params
+
+  let body: { password?: string }
+  try {
+    body = (await request.json()) as { password?: string }
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const password = String(body.password ?? '')
+
+  try {
+    await updatePassword(id, password)
+    return NextResponse.json({ ok: true })
+  } catch (e) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 400 })
+  }
+}

frontend/app/api/admin/users/route.ts

@@ -0,0 +1,41 @@
+import { NextResponse } from 'next/server'
+import { listUsers, createUser } from '@/lib/users'
+import { getSession } from '@/lib/session'
+
+export async function GET() {
+  const session = await getSession()
+  if (!session || session.role !== 'admin') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  const users = await listUsers()
+  return NextResponse.json(users)
+}
+
+export async function POST(request: Request) {
+  const session = await getSession()
+  if (!session || session.role !== 'admin') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
+  let body: { username?: string; password?: string; role?: string }
+  try {
+    body = (await request.json()) as { username?: string; password?: string; role?: string }
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
+  }
+
+  const username = String(body.username ?? '').trim()
+  const password = String(body.password ?? '')
+  const role = body.role === 'admin' ? 'admin' : ('user' as const)
+
+  if (!username || !password) {
+    return NextResponse.json({ error: 'Username and password are required' }, { status: 400 })
+  }
+
+  try {
+    const user = await createUser(username, password, role)
+    return NextResponse.json(user, { status: 201 })
+  } catch (e) {
+    return NextResponse.json({ error: (e as Error).message }, { status: 409 })
+  }
+}