M2: admin console over ssh admin@ (users, sessions, moderation, plugins) (#3)

A privileged operator console reached as `ssh admin@host`, gated by route
plus the $AGENTBBS_ADMINS allowlist (admin status is operator-granted only,
never self-assigned in-band). It is a self-contained Bubble Tea model, not a
hub plugin, so it never appears in the public menu.

Sections (PRD §6):
  - Users & members: list accounts; b = suspend/ban (operators protected).
    Banned accounts are blocked at the hub and pod@ routes.
  - Sessions & pods: live in-memory session registry; k = disconnect.
  - Moderation & audit: admin action log + agent@ transcripts (tab to switch).
  - Config & plugins: runtime snapshot; space = enable/disable a plugin
    (persisted; filtered from the hub on next sign-in).

Every privileged action is written to a new admin_actions audit table.

store: + banned column, admin_actions and plugin_state tables, and the
backing methods (ListUsers/SetBanned/RecentSessions/LogAdminAction/
RecentAdminActions/RecentChatsAll/DisabledPlugins/SetPluginDisabled), with
unit tests. auth: admin allowlist helpers + tests. Docs in docs/admin.md;
README M2 flipped to done.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

internal/auth/auth_test.go

@@ -0,0 +1,42 @@
+package auth
+
+import "testing"
+
+func TestIsAdminName(t *testing.T) {
+	for _, name := range []string{"admin", "ADMIN", "sysop"} {
+		if !IsAdminName(name) {
+			t.Errorf("IsAdminName(%q) = false, want true", name)
+		}
+	}
+	for _, name := range []string{"bbs", "pod", "anthony", ""} {
+		if IsAdminName(name) {
+			t.Errorf("IsAdminName(%q) = true, want false", name)
+		}
+	}
+}
+
+func TestAdminsAllowlist(t *testing.T) {
+	t.Setenv("AGENTBBS_ADMINS", "anthony, Root  ops")
+	admins := Admins()
+	for _, want := range []string{"anthony", "root", "ops"} {
+		if !admins[want] {
+			t.Errorf("expected %q in allowlist, got %v", want, admins)
+		}
+	}
+	if !IsAdmin("ANTHONY") {
+		t.Error("IsAdmin should be case-insensitive")
+	}
+	if IsAdmin("eve") {
+		t.Error("eve must not be an admin")
+	}
+}
+
+func TestAdminsEmpty(t *testing.T) {
+	t.Setenv("AGENTBBS_ADMINS", "")
+	if len(Admins()) != 0 {
+		t.Error("empty env should yield no admins")
+	}
+	if IsAdmin("anyone") {
+		t.Error("nobody is admin when allowlist is empty")
+	}
+}