feat(hub): Phase 10.1–10.4 — Site overlay + admin/moderation UI

- Site overlay: landing page, /about, /downloads (dark/light, responsive)
- User role column (user/moderator/admin) with config-based admin sync
- require_moderator dependency + admin API (8 endpoints: stats, users,
  groups, audit logs)
- Admin SPA panel at #/admin with 5 tabs (stats, users, groups, logs,
  blocklist) — visible only to moderators/admins
- SPA also served at /app/ for Caddy site overlay integration
- GET /v1/users/me returns current user role
- 15 new tests, 147 total passing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 76 insertions, 17 deletions

diff --git a/devel-phases-next.md b/devel-phases-next.md
index 8b96869..f54d0bf 100644
--- a/devel-phases-next.md
+++ b/devel-phases-next.md
@@ -202,6 +202,8 @@ ICE/STUN handles all tested NAT types automatically.
 
 ## Phase 10 — meshbay.org site + admin/moderation UI
 
+Commit: TBD — X files, +Y/−Z lines, 147 tests.
+
 **Objective:** meshbay.org becomes both a production hub and the project's public
 website, with admin/moderation interfaces and user-facing features.
 
@@ -217,9 +219,10 @@ The hub serves the SPA for authenticated users at `/app/`.
 ```
 site/                       # meshbay.org-specific (not in generic hub package)
 ├── index.html              # Landing page — project promotion
-├── downloads.html          # Package repos (Ubuntu, Fedora, Android APK)
+├── downloads.html          # Package repos (placeholder, Phase 13)
 ├── about.html              # Project info, GitHub link, contact
-└── assets/                 # Landing page CSS/images
+└── assets/
+    └── site.css            # Landing page styles (dark/light aware)
 ```
 
 ### User roles
@@ -227,26 +230,82 @@ site/                       # meshbay.org-specific (not in generic hub package)
 | Role | Capabilities |
 |---|---|
 | `user` | Standard user — browse, download, chat, manage own profile |
-| `moderator` | Review reports, suspend content/groups/users | 
-| `admin` | All moderator rights + hub management, user management, logs |
+| `moderator` | Review reports, suspend content/groups/users |
+| `admin` | All moderator rights + hub management (same as moderator for now, distinction reserved for future federation/mirror) |
 
-Role stored on User model. `require_moderator` dependency (checks role ≥ moderator).
-`require_admin` already exists (Phase 8.1 — config-based, extended to DB role).
+Role stored as `role` column on User model (`user` | `moderator` | `admin`).
+`require_moderator` dependency (checks role ≥ moderator OR config allowlist).
+`require_admin` checks role = admin OR config allowlist (backward compat).
+Config-listed admin usernames are synced to `role = "admin"` in DB at startup.
 
 ### Milestones
 
-| # | Component | Priority |
+| # | Component | Status |
 |---|---|---|
-| 10.1 | Landing page + /downloads + /about | High |
-| 10.2 | Moderator role + `require_moderator` dependency | High |
-| 10.3 | Moderation UI (report list, suspend content/group/user) | High |
-| 10.4 | Admin UI (hub management, user list, logs viewer) | High |
-| 10.5 | Notification system (invitations, new content, maintenance) | Medium |
-| 10.6 | User settings (profile, per-group options, privacy, mute) | Medium |
-| 10.7 | Public group search (name + keyword in description) | Medium |
-| 10.8 | Front page (notifications feed, prioritized: contacts → private → public) | Medium |
-| 10.9 | Package repositories (APT for Ubuntu, DNF for Fedora) | Medium |
-| 10.10 | Auto-update check endpoint for clients | Low |
+| 10.1 | Landing page + /downloads + /about | ✅ |
+| 10.2 | Moderator role + `require_moderator` dependency + admin API | ✅ |
+| 10.3 | Moderation UI (user/group suspend, blocklist management) | ✅ |
+| 10.4 | Admin UI (stats, user list, group list, audit logs viewer, blocklist) | ✅ |
+| 10.5 | Notification system (invitations, new content, maintenance) | Deferred |
+| 10.6 | User settings (profile, per-group options, privacy, mute) | Deferred |
+| 10.7 | Public group search (name + keyword in description) | Deferred |
+| 10.8 | Front page (notifications feed, prioritized) | Deferred |
+| 10.9 | Package repositories (APT/DNF) | Deferred to Phase 13 |
+| 10.10 | Auto-update check endpoint for clients | Deferred |
+
+### Admin API endpoints (10.2)
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| GET | `/v1/users/me` | Access token | Current user info (id, username, role, status) |
+| GET | `/v1/admin/stats` | Moderator+ | Hub stats (user/group/node counts, online nodes) |
+| GET | `/v1/admin/users` | Moderator+ | List users (paginated, searchable) |
+| GET | `/v1/admin/users/{id}` | Moderator+ | User detail (email decrypted, group count) |
+| PATCH | `/v1/admin/users/{id}` | Moderator+ | Update role or status |
+| GET | `/v1/admin/groups` | Moderator+ | List groups (with member count) |
+| PATCH | `/v1/admin/groups/{id}` | Moderator+ | Update group status |
+| GET | `/v1/admin/logs` | Moderator+ | IP audit logs (filterable by event, user) |
+
+### Admin UI (10.3–10.4)
+
+Admin page at `#/admin` in SPA, accessible to moderators and admins.
+Five tabs: Stats, Users, Groups, Logs, Blocklist.
+
+- **Stats:** card grid (users, groups, nodes, online nodes)
+- **Users:** searchable table, inline role dropdown, suspend/unsuspend buttons, detail overlay
+- **Groups:** table with member count, suspend/unsuspend
+- **Logs:** filterable IP audit log table, paginated (50/page, load more)
+- **Blocklist:** existing `/v1/admin/blocklist` endpoints, add/remove hashes
+
+### SPA route change
+
+SPA now also served at `/app/` and `/app/{path}` (in addition to `/`).
+With Caddy site overlay, Caddy serves `site/index.html` at `/`,
+and requests to `/app/` fall through to the hub.
+
+### Caddy integration
+
+Recommended Caddyfile snippet for meshbay.org:
+```
+meshbay.org {
+    root * /path/to/meshbay/site
+    try_files {path} {path}.html
+    file_server
+
+    handle /v1/* {
+        reverse_proxy localhost:8000
+    }
+    handle /app* {
+        reverse_proxy localhost:8000
+    }
+    handle /style.css {
+        reverse_proxy localhost:8000
+    }
+    handle /*.js {
+        reverse_proxy localhost:8000
+    }
+}
+```
 
 ### Hub mirror (design only — implementation deferred)