feat: add local admin authentication

app/web/routes.py

@@ -0,0 +1,39 @@
+from fastapi import APIRouter, Form, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.templating import Jinja2Templates
+
+from app.auth.admin import password_matches, require_admin
+from app.auth.csrf import ensure_csrf_token, validate_csrf
+
+router = APIRouter()
+templates = Jinja2Templates(directory="app/web/templates")
+
+
+@router.get("/login", response_class=HTMLResponse)
+def login_page(request: Request):
+    return templates.TemplateResponse(request, "login.html", {"csrf_token": ensure_csrf_token(request)})
+
+
+@router.post("/login")
+def login(
+    request: Request,
+    password: str = Form(...),
+    csrf_token: str = Form(...),
+):
+    validate_csrf(request, csrf_token)
+    settings = request.app.state.settings
+    if not password_matches(password, settings.admin_password):
+        return templates.TemplateResponse(
+            request,
+            "login.html",
+            {"csrf_token": ensure_csrf_token(request), "error": "Invalid password"},
+            status_code=401,
+        )
+    request.session["admin_authenticated"] = True
+    return RedirectResponse("/", status_code=303)
+
+
+@router.get("/", response_class=HTMLResponse)
+def dashboard(request: Request):
+    require_admin(request)
+    return templates.TemplateResponse(request, "dashboard.html", {"csrf_token": ensure_csrf_token(request), "users": []})