Backoffice: PHP admin web UI for licenses, versions, audit

Self-contained admin under /PS_Launcher/admin/ on the same OVH host. No
JS framework, no Composer deps — just PHP 8.3 + sessions + a small CSS.

Auth & infrastructure
---------------------
- admin/lib/Auth.php: session + CSRF helper. Login via password_hash /
  password_verify. session_regenerate_id on successful login.
  config.example.php gains admin_password_hash, generated by:
  php -r "echo password_hash('PWD', PASSWORD_DEFAULT);"
- admin/lib/Layout.php: shared header/footer/nav, formatBytes,
  csrfField helpers.
- admin/.htaccess: noindex / X-Frame-Options DENY / X-Content-Type
  nosniff / blocks lib/*.php from web access.
- admin/assets/style.css: matches launcher's dark theme — same
  Brush.* palette mapped to CSS vars, vivid green/blue/amber status
  pills consistent with the WPF UI.

Pages
-----
- index.php (Dashboard): KPIs (active/expired/revoked licenses, machines
  seen 30d, validations 24h), manifest signature status, last 10
  audit_log entries.
- licenses.php: full CRUD.
  * Émettre: owner, expiration date, max machines, internal notes →
    generates a PRSRV-XXXX-XXXX-XXXX-XXXX key, displays it ONCE in a
    green callout (DB stores the key; the message stays only on this
    request, never shown again).
  * Prolonger (per-row, expandable form), Revoke / Unrevoke,
    Reset machines (frees all slots for that license).
  * Status badge: active / expired / revoked.
- versions.php: edit the manifest from the web.
  * Add a version: number + release date + minLicenseDate + release
    notes Markdown (creates releasenotes/{version}.md). Sets default
    download URL to {base_url}/builds/proserve-{version}.zip.
  * Per-row Méta (edit minLicenseDate / releasedAt), Notes (edit md
    inline), toggle availableForDownload, Delete entry.
  * 🔁 Sync (sign-manifest) button: shells out to
    `php tools/sign-manifest.php` and shows its stdout — recomputes
    sha256/sizeBytes for every uploaded ZIP, bumps `latest`, signs
    Ed25519. Visual indicators on each row: zip presence, hash
    computed yes/no, signature status.
  * Lists orphan ZIPs in builds/ that no manifest entry references.
- audit.php: paginated audit_log viewer (100/page) with event-type
  filter dropdown. JOINs licenses to show owner_name. Color-codes
  events (validate_ok green, expired amber, invalid/revoked red).

Server README rewritten to document the full setup flow:
1. Create MySQL DB, run migrations/001_init.sql
2. Copy config.example.php → config.php, fill db credentials
3. php tools/generate-keypair.php → paste into config.php and into the
   client's Resources/server-pubkey.txt
4. Set admin_password_hash in config.php
5. Login at /PS_Launcher/admin/

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/admin/login.php

@@ -0,0 +1,53 @@
+<?php
+declare(strict_types=1);
+require __DIR__ . '/lib/Auth.php';
+require __DIR__ . '/lib/Layout.php';
+
+use PSLauncher\Admin\Auth;
+use PSLauncher\Admin\Layout;
+
+Auth::start();
+
+// Si déjà connecté, on redirige
+if (Auth::isLoggedIn()) {
+    header('Location: index.php');
+    exit;
+}
+
+$config = require __DIR__ . '/../api/config.php';
+$error = null;
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    Auth::checkCsrf();
+    $user = trim($_POST['username'] ?? '');
+    $pass = $_POST['password'] ?? '';
+    if (Auth::login($user, $pass, $config)) {
+        header('Location: index.php');
+        exit;
+    }
+    $error = 'Identifiants invalides';
+    sleep(1); // throttling très basique
+}
+
+Layout::header('Connexion');
+?>
+<div style="max-width: 400px; margin: 80px auto;">
+    <div class="card">
+        <h1 style="margin-bottom: 8px;">PS_Launcher</h1>
+        <p class="muted" style="margin-top: 0; margin-bottom: 24px;">Backoffice administration</p>
+        <?php Layout::flash($error, 'error'); ?>
+        <form method="post">
+            <?= Layout::csrfField() ?>
+            <div class="field">
+                <label>Utilisateur</label>
+                <input type="text" name="username" required autofocus value="admin">
+            </div>
+            <div class="field">
+                <label>Mot de passe</label>
+                <input type="password" name="password" required>
+            </div>
+            <button class="btn btn-primary" type="submit" style="width:100%; padding: 10px;">Connexion</button>
+        </form>
+    </div>
+</div>
+<?php Layout::footer();