Add launcher engine (scopenet-core) and admin panel server

- scopenet-shared: wire types for branding, auth, instances, manifests
- scopenet-core: Mojang versions/libraries/assets, automatic Java runtimes,
  Fabric/Quilt/Forge/NeoForge installation, file sync, launch command
  builder, Microsoft auth, servers.dat injection, server list ping
- scopenet-panel: Axum + SQLite admin API with JWT auth, users/groups,
  branding, settings, instances, Modrinth/CurseForge/zip import, file
  hosting and launch stats

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ARcGWxLx21FwXJ3yfGriS

panel/server/src/lib.rs

@@ -0,0 +1,100 @@
+//! ScopeNet admin panel.
+
+pub mod auth;
+pub mod config;
+pub mod db;
+pub mod error;
+pub mod packs;
+pub mod routes;
+pub mod state;
+pub mod store;
+
+use axum::http::{header, HeaderValue};
+use axum::Router;
+use rand::RngCore;
+use state::AppState;
+use std::sync::Arc;
+use tower_http::compression::CompressionLayer;
+use tower_http::services::{ServeDir, ServeFile};
+use tower_http::set_header::SetResponseHeaderLayer;
+use tower_http::trace::TraceLayer;
+
+/// Load (or create) the JWT signing secret.
+pub fn jwt_secret(cfg: &config::Config) -> anyhow::Result<Vec<u8>> {
+    if let Some(s) = &cfg.jwt_secret {
+        return Ok(s.as_bytes().to_vec());
+    }
+    let path = cfg.data_dir.join("jwt.secret");
+    if let Ok(bytes) = std::fs::read(&path) {
+        if bytes.len() >= 32 {
+            return Ok(bytes);
+        }
+    }
+    let mut bytes = vec![0u8; 64];
+    rand::thread_rng().fill_bytes(&mut bytes);
+    std::fs::create_dir_all(&cfg.data_dir)?;
+    std::fs::write(&path, &bytes)?;
+    Ok(bytes)
+}
+
+pub async fn build_state(cfg: config::Config, db: sqlx::SqlitePool) -> anyhow::Result<AppState> {
+    let secret = jwt_secret(&cfg)?;
+    Ok(AppState {
+        db,
+        keys: Arc::new(auth::Keys::new(&secret)),
+        http: scopenet_core::http::client(),
+        login_guard: Arc::new(auth::LoginGuard::default()),
+        cfg: Arc::new(cfg),
+    })
+}
+
+/// Create the first admin account if none exists.
+pub async fn bootstrap_admin(state: &AppState) -> anyhow::Result<()> {
+    let admins: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM users WHERE role = 'admin'").fetch_one(&state.db).await?;
+    if admins > 0 {
+        return Ok(());
+    }
+    let (password, generated) = match &state.cfg.admin_password {
+        Some(p) => (p.clone(), false),
+        None => {
+            let mut bytes = [0u8; 12];
+            rand::thread_rng().fill_bytes(&mut bytes);
+            (hex::encode(bytes), true)
+        }
+    };
+    let hash = auth::hash_password(&password).map_err(|e| anyhow::anyhow!(e.message))?;
+    sqlx::query("INSERT INTO users (username, password_hash, role, status, created_at) VALUES (?, ?, 'admin', 'active', ?)")
+        .bind(&state.cfg.admin_username)
+        .bind(hash)
+        .bind(db::now())
+        .execute(&state.db)
+        .await?;
+    if generated {
+        tracing::warn!("============================================================");
+        tracing::warn!(" Created admin account '{}' with password: {password}", state.cfg.admin_username);
+        tracing::warn!(" Set ADMIN_PASSWORD to choose your own. Change it after login!");
+        tracing::warn!("============================================================");
+    } else {
+        tracing::info!("created admin account '{}'", state.cfg.admin_username);
+    }
+    Ok(())
+}
+
+pub fn app(state: AppState) -> Router {
+    let web = &state.cfg.web_dir;
+    let spa = ServeDir::new(web).fallback(ServeFile::new(web.join("index.html")));
+    let long_cache = SetResponseHeaderLayer::overriding(header::CACHE_CONTROL, HeaderValue::from_static("public, max-age=86400"));
+
+    Router::new()
+        .route("/healthz", axum::routing::get(routes::public::health))
+        .merge(routes::api(&state))
+        .nest_service("/files", ServeDir::new(state.cfg.files_dir()))
+        .nest_service(
+            "/uploads",
+            tower::ServiceBuilder::new().layer(long_cache).service(ServeDir::new(state.cfg.uploads_dir())),
+        )
+        .fallback_service(spa)
+        .layer(CompressionLayer::new())
+        .layer(TraceLayer::new_for_http())
+        .with_state(state)
+}