Add the administration pages to the web interface

Running the server meant running the API by hand: invites, accounts,
groups and grants existed only as endpoints and CLI commands, so the
browser could create a vault and nothing else.

/web/groups walks the group tree and opens onto one group's members,
roles and vault access, including the grants it inherits from above and
where they come from. /web/users lists the accounts you may see, and
lets a server administrator disable, enable, clear a lost second
factor, promote, demote or delete one. /web/invites shows the
outstanding links with their use counts, issues new ones and revokes
them.

Every administrative change is now a function of the state and the
caller in admin.go, which both the JSON handlers and the forms call. The
alternative was a second copy of the permission rules behind the pages,
which would have drifted on the first change. The same move gave the API
the two verbs it was missing: DELETE /api/v1/invites/{token} and
PATCH /api/v1/users/{id}.

Account changes are server-administrator only. A group administrator
decides who reaches which vault; disabling an account or clearing
somebody's second factor reaches past the group they share. Disable and
delete revoke that account's sessions, and the three changes that would
lock the caller out are refused on their own account.

Pages go through webPage and forms through webForm, so the session and
CSRF checks cannot be forgotten on a new form. No page carries any
JavaScript.

Server 0.6.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/server/server.go

@@ -180,16 +180,26 @@ func (s *Server) routes() {
 	m.HandleFunc("POST /api/v1/auth/device/start", s.handleDeviceStart)
 	m.HandleFunc("POST /api/v1/auth/device/poll", s.handleDevicePoll)
 
-	// The web interface: sign in, see your vaults, create one.
+	// The web interface: sign in, see your vaults, create one, and run the
+	// server. Every page goes through webPage and every form through
+	// webForm, which is where the session and the CSRF token are checked.
 	m.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/web", http.StatusFound)
 	})
 	m.HandleFunc("GET /web", s.handleWebHome)
 	m.HandleFunc("POST /web/signin", s.handleWebSignIn)
-	m.HandleFunc("POST /web/signout", s.handleWebSignOut)
-	m.HandleFunc("GET /web/vaults", s.handleWebVaults)
-	m.HandleFunc("POST /web/vaults", s.handleWebCreateVault)
-	m.HandleFunc("POST /web/password", s.handleWebChangePassword)
+	m.HandleFunc("POST /web/signout", s.webForm(s.handleWebSignOut))
+	m.HandleFunc("GET /web/vaults", s.webPage(s.handleWebVaults))
+	m.HandleFunc("POST /web/vaults", s.webForm(s.handleWebCreateVault))
+	m.HandleFunc("POST /web/password", s.webForm(s.handleWebChangePassword))
+	m.HandleFunc("GET /web/groups", s.webPage(s.handleWebGroups))
+	m.HandleFunc("POST /web/groups", s.webForm(s.handleWebCreateGroup))
+	m.HandleFunc("GET /web/groups/{id}", s.webPage(s.handleWebGroup))
+	m.HandleFunc("POST /web/groups/{id}", s.webForm(s.handleWebGroupAction))
+	m.HandleFunc("GET /web/users", s.webPage(s.handleWebUsers))
+	m.HandleFunc("POST /web/users", s.webForm(s.handleWebUserAction))
+	m.HandleFunc("GET /web/invites", s.webPage(s.handleWebInvites))
+	m.HandleFunc("POST /web/invites", s.webForm(s.handleWebInviteAction))
 
 	// Browser-facing pages: device approval, invite registration, OIDC.
 	m.HandleFunc("GET /device", s.handleDevicePage)
@@ -222,7 +232,9 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE /api/v1/grants", s.authed(s.handleDeleteGrant))
 	m.HandleFunc("POST /api/v1/invites", s.authed(s.handleCreateInvite))
 	m.HandleFunc("GET /api/v1/invites", s.authed(s.handleListInvites))
+	m.HandleFunc("DELETE /api/v1/invites/{token}", s.authed(s.handleRevokeInvite))
 	m.HandleFunc("GET /api/v1/users", s.authed(s.handleListUsers))
+	m.HandleFunc("PATCH /api/v1/users/{id}", s.authed(s.handlePatchUser))
 }
 
 // ---- request plumbing ----