remove preact and create setup wizard

apps/server/internal/httpserver/auth_handlers.go

@@ -24,6 +24,13 @@ type passwordLoginRequest struct {
 	Password string `json:"password"`
 }
 
+type initialSetupRequest struct {
+	Email          string `json:"email"`
+	DisplayName    string `json:"displayName"`
+	Password       string `json:"password"`
+	SignupsEnabled bool   `json:"signupsEnabled"`
+}
+
 type passkeyBeginRequest struct {
 	Email       string `json:"email"`
 	DisplayName string `json:"displayName"`
@@ -67,17 +74,61 @@ func (s *Server) handleLoginPage(w http.ResponseWriter, r *http.Request) {
 	if !strings.HasPrefix(nextPath, "/") || strings.HasPrefix(nextPath, "//") {
 		nextPath = "/account"
 	}
+	settings, err := s.auth.GetInstanceSettings(r.Context())
+	if err != nil {
+		s.renderError(w, r, http.StatusInternalServerError, "load registration settings")
+		return
+	}
 	s.renderTemplate(w, http.StatusOK, "login.gohtml", layoutData{
 		Title:        "Sign in",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-auth",
 		BodyTemplate: "login_content",
 		Data: struct {
-			Next string
-		}{Next: nextPath},
+			Next           string
+			SignupsEnabled bool
+		}{Next: nextPath, SignupsEnabled: settings.SignupsEnabled},
 	})
 }
 
+func (s *Server) handleSetupPage(w http.ResponseWriter, r *http.Request) {
+	settings, err := s.auth.GetInstanceSettings(r.Context())
+	if err != nil {
+		s.renderError(w, r, http.StatusInternalServerError, "load initial setup state")
+		return
+	}
+	if settings.SetupComplete {
+		http.Redirect(w, r, "/login", http.StatusSeeOther)
+		return
+	}
+	s.renderTemplate(w, http.StatusOK, "setup.gohtml", layoutData{
+		Title:        "Initial setup",
+		BodyClass:    "page-auth",
+		BodyTemplate: "setup_content",
+	})
+}
+
+func (s *Server) handleSetup(w http.ResponseWriter, r *http.Request) {
+	if !s.allowAuthAttempt(w, r) {
+		return
+	}
+	var req initialSetupRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": "invalid json"})
+		return
+	}
+	if _, err := s.auth.CompleteInitialSetup(r.Context(), req.Email, req.DisplayName, req.Password, req.SignupsEnabled); err != nil {
+		writeJSONWithStatus(w, http.StatusBadRequest, map[string]string{"error": err.Error()})
+		return
+	}
+	principal, token, err := s.auth.LoginPassword(r.Context(), req.Email, req.Password, requestIP(r), r.UserAgent())
+	if err != nil {
+		writeJSONWithStatus(w, http.StatusInternalServerError, map[string]string{"error": "initial admin created; sign in to continue"})
+		return
+	}
+	setSessionCookie(w, r, token, principal.ExpiresAt)
+	writeJSONWithStatus(w, http.StatusCreated, map[string]any{"principal": principal})
+}
+
 func (s *Server) handleAccountPage(w http.ResponseWriter, r *http.Request) {
 	principal, ok := requirePrincipal(r)
 	if !ok {
@@ -86,7 +137,6 @@ func (s *Server) handleAccountPage(w http.ResponseWriter, r *http.Request) {
 	}
 	s.renderTemplate(w, http.StatusOK, "account.gohtml", layoutData{
 		Title:        "Account",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-account",
 		BodyTemplate: "account_content",
 		Data:         principal,
@@ -377,7 +427,6 @@ func (s *Server) handleDeviceVerifyPage(w http.ResponseWriter, r *http.Request)
 	userCode := strings.TrimSpace(r.URL.Query().Get("user_code"))
 	s.renderTemplate(w, http.StatusOK, "device_verify.gohtml", layoutData{
 		Title:        "Approve device",
-		WebEnabled:   s.webEnabled,
 		BodyClass:    "page-auth",
 		BodyTemplate: "device_verify_content",
 		Data: struct {