feat(hub): Phase 10.1–10.4 — Site overlay + admin/moderation UI

- Site overlay: landing page, /about, /downloads (dark/light, responsive)
- User role column (user/moderator/admin) with config-based admin sync
- require_moderator dependency + admin API (8 endpoints: stats, users,
  groups, audit logs)
- Admin SPA panel at #/admin with 5 tabs (stats, users, groups, logs,
  blocklist) — visible only to moderators/admins
- SPA also served at /app/ for Caddy site overlay integration
- GET /v1/users/me returns current user role
- 15 new tests, 147 total passing

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 22 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/app.py b/packages/meshbay-hub/src/meshbay_hub/app.py
index 1b12a37..d7f95cf 100644
--- a/packages/meshbay-hub/src/meshbay_hub/app.py
+++ b/packages/meshbay-hub/src/meshbay_hub/app.py
@@ -33,10 +33,28 @@ from meshbay_hub.csam            import csam_router
 from meshbay_hub.api.health      import router as health_router
 from meshbay_hub.api.relay       import router as relay_router
 from meshbay_hub.api.signaling   import router as signaling_router
+from meshbay_hub.api.admin       import router as admin_router
 from meshbay_hub.api.webapp     import router as webapp_router, STATIC_DIR
 from meshbay_hub.api.middleware import limiter
 
 
+async def _sync_admin_roles(admin_usernames: list[str]) -> None:
+    """Ensure config-listed admin usernames have role='admin' in the DB."""
+    from sqlalchemy import select, update
+    from meshbay_hub.db.engine import get_session_factory
+    from meshbay_hub.db.models import User
+
+    factory = get_session_factory()
+    async with factory() as session:
+        result = await session.execute(
+            select(User).where(User.username.in_(admin_usernames))
+        )
+        for user in result.scalars().all():
+            if user.role != "admin":
+                user.role = "admin"
+        await session.commit()
+
+
 def create_app(cfg: HubConfig | None = None) -> FastAPI:
     from meshbay_hub.config import load_config
     if cfg is None:
@@ -54,6 +72,9 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
         users_set_config(cfg)
         set_admin_usernames(cfg.identity.admin_usernames)
 
+        if cfg.identity.admin_usernames:
+            await _sync_admin_roles(cfg.identity.admin_usernames)
+
         from meshbay_hub.csam import get_csam_checker
         get_csam_checker().load()
 
@@ -95,6 +116,7 @@ def create_app(cfg: HubConfig | None = None) -> FastAPI:
     app.include_router(health_router)
     app.include_router(relay_router)
     app.include_router(signaling_router)
+    app.include_router(admin_router)
     app.include_router(webapp_router)
 
     from starlette.staticfiles import StaticFiles