feat: M5 admin dashboard (HTMX + Tailwind CDN, embedded HTML)

A web admin UI for the rustdesk-server, mounted at /admin/* on the
existing HTTP API listener. Single-binary deploy preserved — the two
HTML files live in admin_ui/ and are pulled into the binary via
include_str! at build time, so there's nothing extra to ship.

================================================================================
Architecture
================================================================================
- Stack: HTMX 1.9 + Tailwind play CDN. No SPA, no Node toolchain. Pages
  are server-rendered HTML fragments returned by Rust handlers via
  Html<String>; the index.html shell uses hx-get to drop a fragment into
  the main pane and hx-push-url for back-button history.
- Auth: same Bearer-token table the API uses. The dashboard log-in form
  POSTs username + password (+ optional TOTP) to /admin/login; on success
  the server mints a token and pins it in an HttpOnly + SameSite=Strict
  cookie (`rd_admin_session`). The AuthedUser extractor was extended to
  accept either the Authorization: Bearer header (curl, desktop client)
  OR the session cookie (browser).
- Embedding: src/api/admin/mod.rs has `include_str!("../../../admin_ui/index.html")`
  + login.html. No tower_http::ServeDir wildcard — we ran into axum 0.5
  routing conflicts between literal /admin/login routes and an /admin/*
  catch-all, so each HTML file is its own explicit route.

================================================================================
M5a — foundation
================================================================================
Files:
  admin_ui/index.html   page shell + sidebar + HTMX + 401-bounces-to-login
  admin_ui/login.html   credentials + TOTP form, posts to /admin/login
  src/api/admin/mod.rs  router + include_str! + Cache-Control: no-cache
  src/api/admin/auth.rs /admin/login POST (form-encoded), /admin/logout POST
  src/api/admin/me.rs   sidebar fragment ("Signed in as <name>")
  src/api/middleware.rs `AuthedUser` now reads either Bearer OR cookie
  src/api/state.rs      `admin_ui_dir` (informational; UI is embedded)
  src/main.rs           --admin-ui-dir flag (empty disables the dashboard)

The login flow asks for TOTP transparently in the same form when the
target user has a secret enrolled, so the dashboard inherits the TOTP
gate from the API auth surface for free.

================================================================================
M5b — full CRUD pages
================================================================================
- Users (src/api/admin/pages/users.rs) — list, create, password reset,
  toggle admin / status, TOTP enroll / unenroll, delete. TOTP enroll
  surfaces the secret + otpauth URL once, on a dismissible banner above
  the table.
- Devices (devices.rs) — list with hostname/OS/last-heartbeat/conn count,
  force-disconnect (queues `heartbeat_commands` row consumed at the next
  /api/heartbeat tick), force-sysinfo refresh.
- Device groups (groups.rs) — list / create / delete / add member /
  remove member. Per-group section, with an add-member dropdown of users
  not yet in the group.
- Strategies (strategies.rs) — list / create / edit config_options /
  delete. config_options is validated as a JSON object on the server side
  before persist; bad JSON is reflected to the page with a friendly
  error notice.
- Address books (address_books.rs) — read-only overview of all books
  with owner, kind (personal / shared badge), peer count, GUID.
- OIDC providers (oidc.rs) — read-only list of what's configured. Editing
  remains operator-side via --oidc-config TOML or direct SQL.

================================================================================
M5c — audit + recordings browsers
================================================================================
- Audit log (audit.rs) — three tabs (Connections / File transfers /
  Alarms), each capped at the latest 200 rows. Tab pills are HTMX links
  with hx-get + hx-target="#main" so the tab switch is a single fetch.
- Recordings (recordings.rs) — read-only list with peer / size / state /
  start / finish. Streaming download is a follow-up; for now operators
  pull files from --recording-dir directly.

================================================================================
DB methods added
================================================================================
- Users:    users_list_all, user_set_status, user_set_admin,
            user_set_password, user_delete, user_has_totp,
            raw_update_user_email
- Devices:  devices_list_all, device_sysinfo_get_conns,
            heartbeat_command_queue (also used elsewhere; surfaced)
- Groups:   device_groups_list_all, device_group_members,
            device_group_create, device_group_delete,
            device_group_add_member, device_group_remove_member
- Strategy: strategies_list_all, strategy_create,
            strategy_update_config, strategy_delete
- Audit:    audit_conn_list, audit_file_list, audit_alarm_list
- Misc:     ab_list_all_with_owner, recordings_list

All use the runtime sqlx::query("...") form (matching the project-wide
convention) so the SQLite compile-time-check macros don't require these
new tables to pre-exist in the dev DB.

================================================================================
Conventions enforced
================================================================================
- Every page handler gates on require_admin(&AuthedUser) — non-admin
  users get an HTTP 403 + JSON envelope, which the SPA shell catches and
  bounces back to the login form.
- HTML fragments are produced via `format!`-with-named-args; html_escape
  is centralized in src/api/admin/pages/shared.rs and applied to every
  user-supplied string before it lands in the DOM.
- All mutations return either the updated table fragment OR
  notice_html(kind, msg) + the table — same pattern across pages, so
  HTMX swap targets stay simple (always #region innerHTML).
- Cookie carries no path restriction so it also authorizes /api/* calls
  the dashboard might want to make from the browser; HttpOnly +
  SameSite=Strict mitigates XSS / CSRF; Max-Age tracks ApiConfig's
  session_ttl_secs (30 days).

================================================================================
Verification
================================================================================
1. cargo build --release — clean.
2. End-to-end smoke test:
   - /admin/ serves index.html (4406 bytes), /admin/login.html serves
     login.html (2598 bytes).
   - POST /admin/login with valid creds returns 200 + Set-Cookie
     `rd_admin_session=…; HttpOnly; Path=/; SameSite=Strict; Max-Age=…`.
   - All eight /admin/pages/* fragments return 200 with cookie.
   - Users CRUD round-trip: create alice → toggle admin → disable →
     reset password → enroll TOTP (32-char secret displayed once) →
     unenroll → delete; self-action guard rejects suicide deletes.
   - Groups CRUD: create engineering → add alice as member → SQL
     confirms the row.
   - Strategies: valid JSON accepted, invalid JSON rejected with a
     friendly notice.
   - Audit tabs: all three render 200; empty-state messages appear when
     no rows.
   - /admin/logout clears the cookie; subsequent /admin/me returns 401.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/api/admin/pages/devices.rs

@@ -0,0 +1,211 @@
+//! Devices page — list devices currently / recently registered, with
+//! force-disconnect (queues a `heartbeat_commands` row consumed on the
+//! peer's next /api/heartbeat tick) and force-sysinfo refresh.
+
+use crate::api::error::ApiError;
+use crate::api::middleware::AuthedUser;
+use crate::api::state::AppState;
+use crate::database::DashboardDeviceRow;
+use axum::extract::{Extension, Path};
+use axum::response::Html;
+use std::fmt::Write as _;
+use std::sync::Arc;
+
+const PAGE_SIZE: i64 = 100;
+
+pub async fn index(
+    Extension(state): Extension<Arc<AppState>>,
+    admin: AuthedUser,
+) -> Result<Html<String>, ApiError> {
+    require_admin(&admin)?;
+    let table = render_table(&state).await?;
+    Ok(Html(format!(
+        r##"<div class="space-y-6">
+  <header class="flex items-center justify-between">
+    <h2 class="text-lg font-semibold">Devices</h2>
+    <p class="text-xs text-slate-500">Force-disconnect / force-sysinfo are delivered on the peer's next heartbeat tick (~15 s).</p>
+  </header>
+  <section id="devices-region">
+    {table}
+  </section>
+</div>"##
+    )))
+}
+
+pub async fn force_disconnect(
+    Extension(state): Extension<Arc<AppState>>,
+    admin: AuthedUser,
+    Path(peer_id): Path<String>,
+) -> Result<Html<String>, ApiError> {
+    require_admin(&admin)?;
+    let conns = state
+        .db
+        .device_sysinfo_get_conns(&peer_id)
+        .await
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
+    state
+        .db
+        .heartbeat_command_queue(&peer_id, "disconnect", Some(&conns))
+        .await
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
+    notice_then_table(
+        &state,
+        "ok",
+        &format!("Queued disconnect for {} (conns={})", peer_id, conns),
+    )
+    .await
+}
+
+pub async fn force_sysinfo(
+    Extension(state): Extension<Arc<AppState>>,
+    admin: AuthedUser,
+    Path(peer_id): Path<String>,
+) -> Result<Html<String>, ApiError> {
+    require_admin(&admin)?;
+    state
+        .db
+        .heartbeat_command_queue(&peer_id, "sysinfo", None)
+        .await
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
+    notice_then_table(
+        &state,
+        "ok",
+        &format!("Queued sysinfo refresh for {}", peer_id),
+    )
+    .await
+}
+
+// ---------- helpers ----------
+
+async fn render_table(state: &Arc<AppState>) -> Result<String, ApiError> {
+    let (total, devices) = state
+        .db
+        .devices_list_all(0, PAGE_SIZE)
+        .await
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
+    let mut s = String::new();
+    let _ = write!(
+        s,
+        r##"<div class="rounded-md border border-slate-800 bg-slate-900 overflow-hidden">
+<table class="w-full text-sm">
+  <thead class="text-xs uppercase text-slate-500 bg-slate-950">
+    <tr>
+      <th class="text-left font-medium px-3 py-2">Peer ID</th>
+      <th class="text-left font-medium px-3 py-2">Owner</th>
+      <th class="text-left font-medium px-3 py-2">Hostname</th>
+      <th class="text-left font-medium px-3 py-2">OS</th>
+      <th class="text-left font-medium px-3 py-2">Last heartbeat</th>
+      <th class="text-left font-medium px-3 py-2">Conns</th>
+      <th class="text-right font-medium px-3 py-2 w-1">Actions</th>
+    </tr>
+  </thead>
+  <tbody class="divide-y divide-slate-800">"##
+    );
+    if devices.is_empty() {
+        s.push_str(
+            r##"<tr><td colspan="7" class="px-3 py-4 text-slate-500 text-center text-xs">No devices have heartbeated yet.</td></tr>"##,
+        );
+    }
+    for d in &devices {
+        render_device_row(&mut s, d);
+    }
+    let _ = write!(
+        s,
+        r##"</tbody>
+</table>
+<div class="px-3 py-2 text-xs text-slate-500 border-t border-slate-800">{total} device(s).</div>
+</div>"##
+    );
+    Ok(s)
+}
+
+fn render_device_row(s: &mut String, d: &DashboardDeviceRow) {
+    let parsed: serde_json::Value =
+        serde_json::from_str(&d.sysinfo_payload).unwrap_or(serde_json::Value::Null);
+    let pick = |k: &str| -> String {
+        parsed
+            .get(k)
+            .and_then(|v| v.as_str())
+            .unwrap_or_default()
+            .to_string()
+    };
+    let hostname = pick("hostname");
+    let os = pick("os");
+    let conn_count = serde_json::from_str::<Vec<i64>>(&d.conns_json)
+        .map(|v| v.len())
+        .unwrap_or(0);
+    let _ = write!(
+        s,
+        r##"<tr class="hover:bg-slate-800/40">
+  <td class="px-3 py-2 font-mono text-slate-200">{id}</td>
+  <td class="px-3 py-2 text-slate-300">{owner}</td>
+  <td class="px-3 py-2 text-slate-400">{host}</td>
+  <td class="px-3 py-2 text-slate-400">{os}</td>
+  <td class="px-3 py-2 text-slate-500 text-xs">{last}</td>
+  <td class="px-3 py-2 text-slate-400">{n}</td>
+  <td class="px-3 py-2">
+    <details class="text-right relative">
+      <summary class="cursor-pointer list-none text-xs text-slate-400 hover:text-slate-200 select-none">···</summary>
+      <div class="absolute right-2 mt-1 z-10 w-56 bg-slate-900 border border-slate-700 rounded shadow-lg p-2 space-y-1 text-left">
+        <button class="w-full text-left px-2 py-1 text-xs hover:bg-slate-800 rounded"
+          hx-post="/admin/pages/devices/{id}/disconnect"
+          hx-target="#devices-region" hx-swap="innerHTML"
+          hx-confirm="Disconnect all active sessions on {id}?">
+          Force disconnect
+        </button>
+        <button class="w-full text-left px-2 py-1 text-xs hover:bg-slate-800 rounded"
+          hx-post="/admin/pages/devices/{id}/sysinfo-refresh"
+          hx-target="#devices-region" hx-swap="innerHTML">
+          Force sysinfo refresh
+        </button>
+      </div>
+    </details>
+  </td>
+</tr>"##,
+        id = html_escape(&d.id),
+        owner = html_escape(&d.owner_username),
+        host = html_escape(&hostname),
+        os = html_escape(&os),
+        last = html_escape(&d.last_heartbeat_at),
+        n = conn_count
+    );
+}
+
+async fn notice_then_table(
+    state: &Arc<AppState>,
+    kind: &str,
+    msg: &str,
+) -> Result<Html<String>, ApiError> {
+    let mut html = notice_html(kind, msg);
+    html.push_str(&render_table(state).await?);
+    Ok(Html(html))
+}
+
+fn notice_html(kind: &str, msg: &str) -> String {
+    let (border, bg, text) = match kind {
+        "ok" => ("emerald-700/50", "emerald-900/30", "emerald-300"),
+        _ => ("rose-700/50", "rose-900/30", "rose-300"),
+    };
+    format!(
+        r##"<div class="rounded border border-{border} bg-{bg} p-3 mb-4 text-sm text-{text}">{msg}</div>"##,
+        border = border,
+        bg = bg,
+        text = text,
+        msg = html_escape(msg),
+    )
+}
+
+fn html_escape(s: &str) -> String {
+    s.replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+}
+
+fn require_admin(u: &AuthedUser) -> Result<(), ApiError> {
+    if u.is_admin {
+        Ok(())
+    } else {
+        Err(ApiError::Forbidden("admin required".into()))
+    }
+}