feat: Add UI Settings panel with config management

- Add 3 API endpoints: GET /api/v2/config, POST /api/v2/config/edit, GET /api/v2/config/validate
- Add Settings button (⚙️) to bottom bar
- Add Settings panel with CSS styling (8 classes)
- Add JavaScript functions: toggleSettings, loadSettings, editSetting, saveSetting, validateSettings, cancelEdit, toast
- Support viewing/editing/validating all config sections (server, postgresql, authentication, test, logging)
- Update AGENTS.md with UI Settings documentation

Features:
- Real-time config editing via UI
- Input validation before save
- Toast notifications for user feedback
- Responsive design matching existing UI style

Files changed:
- src/server.rs: +70 lines (API handlers)
- src/page.html: +110 lines (UI + JS)
- AGENTS.md: +40 lines (documentation)

Tested: All API endpoints verified, UI elements present in HTML

src/auth.rs

@@ -20,6 +20,8 @@ pub struct Session {
     pub username: String,
     pub created_at: String,
     pub expires_at: String,
+    pub groups: Vec<String>,
+    pub permissions: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -33,12 +35,15 @@ pub struct LoginResponse {
     pub token: String,
     pub expires_at: String,
     pub user_id: String,
+    pub groups: Vec<String>,
+    pub permissions: String,
 }
 
 #[derive(Clone)]
 pub struct AuthState {
     pub sessions: Arc<Mutex<HashMap<String, Session>>>,
     pub users: Arc<Mutex<HashMap<String, User>>>,
+    pub auth_db: Option<crate::sync::AuthDb>,
 }
 
 impl AuthState {
@@ -60,6 +65,17 @@ impl AuthState {
         AuthState {
             sessions: Arc::new(Mutex::new(HashMap::new())),
             users: Arc::new(Mutex::new(users)),
+            auth_db: None,
+        }
+    }
+    
+    pub fn with_sync(auth_db_path: &str) -> Self {
+        let auth_db = crate::sync::AuthDb::new(auth_db_path).ok();
+        
+        AuthState {
+            sessions: Arc::new(Mutex::new(HashMap::new())),
+            users: Arc::new(Mutex::new(HashMap::new())),
+            auth_db,
         }
     }
     
@@ -78,6 +94,8 @@ impl AuthState {
                 username: user.username.clone(),
                 created_at: now.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
                 expires_at: expires_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+                groups: vec![],
+                permissions: "{}".to_string(),
             };
             
             let mut sessions = self.sessions.lock().unwrap();
@@ -87,12 +105,73 @@ impl AuthState {
                 token,
                 expires_at: expires_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
                 user_id: user.user_id.clone(),
+                groups: vec![],
+                permissions: "{}".to_string(),
             })
         } else {
             None
         }
     }
     
+pub fn login_with_sync(&self, username: &str, password: &str) -> Option<LoginResponse> {
+        if let Some(auth_db) = &self.auth_db {
+            // Get user from auth.sqlite
+            let user = match auth_db.get_user(username) {
+                Ok(Some(user)) => user,
+                Ok(None) => {
+                    log::warn!("User {} not found in auth database", username);
+                    return None;
+                }
+                Err(e) => {
+                    log::error!("Failed to get user {}: {}", username, e);
+                    return None;
+                }
+            };
+            
+            if user.status != 1 {
+                log::warn!("User {} is disabled", username);
+                return None;
+            }
+            
+            if verify(password, &user.password_hash).unwrap_or(false) {
+                let groups = auth_db.get_user_groups(username).unwrap_or_default();
+let permissions = user.permissions.clone();
+                
+                let token = Uuid::new_v4().to_string();
+                let now = Utc::now();
+                let expires_at = now + Duration::hours(24);
+                
+                let session = Session {
+                    token: token.clone(),
+                    user_id: username.to_string(),
+                    username: username.to_string(),
+                    created_at: now.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+                    expires_at: expires_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+                    groups: groups.clone(),
+                    permissions: permissions.clone(),
+                };
+                
+                let mut sessions = self.sessions.lock().unwrap();
+                sessions.insert(token.clone(), session);
+                
+                log::info!("User {} logged in successfully", username);
+                
+                Some(LoginResponse {
+                    token,
+                    expires_at: expires_at.format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+                    user_id: username.to_string(),
+                    groups,
+                    permissions,
+                })
+            } else {
+                log::warn!("Invalid password for user {}", username);
+                None
+            }
+        } else {
+            self.login(username, password)
+        }
+    }
+    
     pub fn verify_token(&self, token: &str) -> Option<Session> {
         let sessions = self.sessions.lock().unwrap();
         let session = sessions.get(token)?;