feat(admin): password-auth admin panel with 8 pages + 15 API endpoints

Schema migrations:
- users.is_admin boolean
- users.password_hash text (scrypt N=16384, 16-byte salt)
- users.last_login_at timestamp
- organizations.suspended + suspended_reason
- admin_settings table (DB-stored prompt override + future settings)

Auth (@bmm/auth):
- hashPassword + verifyPassword via node:crypto scrypt (no extra dep)
- loginWithPassword: scrypt-verifies, issues 30-day session, updates last_login_at
- seedAdmin: idempotent upsert keyed on email; creates org + membership on first run
- AuthedUser now carries isAdmin flag

API:
- POST /v1/auth/admin/login (email + password) — 300ms throttle on failure
- requireAdmin preHandler — 401 if no session, 403 if non-admin
- Bootstrap: api on boot calls seedAdmin(ADMIN_EMAIL, ADMIN_PASSWORD, ADMIN_NAME)
  if env present. Idempotent.

Admin API routes (all gated by requireAdmin):
- GET /v1/admin/overview (totals, trends 7d, server-status breakdown, builds 24h, recent activity)
- GET /v1/admin/users (search, per-row org + plan + serverCount)
- PATCH /v1/admin/users/:id (isAdmin, name)
- DELETE /v1/admin/users/:id (self-delete blocked)
- GET /v1/admin/orgs (member + server counts)
- PATCH /v1/admin/orgs/:id (plan, quota, suspended; cascades to mcp_servers.status=paused on suspend)
- GET /v1/admin/servers (cross-org with status filter)
- POST /v1/admin/servers/:id/rebuild (re-queues build using last prompt)
- DELETE /v1/admin/servers/:id
- GET /v1/admin/builds (status filter, error messages, prompt previews)
- GET /v1/admin/builds/:id/logs
- GET /v1/admin/audit (system-wide with user email join)
- GET /v1/admin/system (DB ping, Redis ping, BullMQ queue depth, docker ps count)
- GET /v1/admin/prompt (builtin + override + updatedAt)
- PATCH /v1/admin/prompt (value: string | null) — saves DB override or drops it

UI (apps/web/app/admin/*):
- /admin/login — password form, separate from /login magic-link
- AdminLayout — Linear-style sidebar (8 nav items), bottom panel with user email +
  'user view' shortcut + logout, client-side requireAdmin guard with redirect
- /admin — overview dashboard with 4 metric cards, 2 panels (status + 24h builds),
  recent activity table linking to full audit
- /admin/users — search + admin toggle + delete (self-delete blocked)
- /admin/orgs — plan/quota/suspend actions via prompts
- /admin/servers — cross-org table with rebuild + delete actions, status filter
- /admin/builds — every build cross-fleet with error vs prompt preview
- /admin/audit — system-wide log + CSV export + filter dropdowns
- /admin/system — auto-refreshing 5s health probes for Postgres, Redis, queue, Docker
- /admin/prompt — live editor for the LLM system prompt with built-in baseline,
  override-state badge, drop-override action, diff preview, save-as-override

End-to-end verified: login as marco.frangiskatos@gmail.com + Melusa112233.*, every
admin page returns 200, admin login + overview tested via screenshot, docker probe
returns true count of running MCP containers.

packages/auth/src/index.ts

@@ -3,6 +3,8 @@ import { and, createDb, eq, gt, type Database, magicLinks, memberships, organiza
 
 const MAGIC_LINK_TTL_MS = 15 * 60 * 1000; // 15 min
 const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+const SCRYPT_KEYLEN = 64;
+const SCRYPT_N = 16_384;
 
 function sha256(input: string): string {
   return crypto.createHash('sha256').update(input).digest('hex');
@@ -12,6 +14,27 @@ function randomToken(bytes = 32): string {
   return crypto.randomBytes(bytes).toString('base64url');
 }
 
+export function hashPassword(password: string): string {
+  const salt = crypto.randomBytes(16).toString('hex');
+  const derived = crypto
+    .scryptSync(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N })
+    .toString('hex');
+  return `scrypt$${SCRYPT_N}$${salt}$${derived}`;
+}
+
+export function verifyPassword(password: string, stored: string): boolean {
+  const parts = stored.split('$');
+  if (parts.length !== 4 || parts[0] !== 'scrypt') return false;
+  const N = Number.parseInt(parts[1] ?? '', 10);
+  const salt = parts[2];
+  const expectedHex = parts[3];
+  if (!Number.isFinite(N) || !salt || !expectedHex) return false;
+  const expected = Buffer.from(expectedHex, 'hex');
+  const actual = crypto.scryptSync(password, salt, expected.length, { N });
+  if (actual.length !== expected.length) return false;
+  return crypto.timingSafeEqual(actual, expected);
+}
+
 function slugify(input: string): string {
   return input
     .toLowerCase()
@@ -105,6 +128,7 @@ export interface AuthedUser {
   orgId: string;
   email: string;
   role: string;
+  isAdmin: boolean;
 }
 
 export async function getSession(
@@ -118,6 +142,7 @@ export async function getSession(
       userId: sessions.userId,
       expiresAt: sessions.expiresAt,
       email: users.email,
+      isAdmin: users.isAdmin,
     })
     .from(sessions)
     .innerJoin(users, eq(users.id, sessions.userId))
@@ -130,7 +155,13 @@ export async function getSession(
     .where(eq(memberships.userId, row.userId))
     .limit(1);
   if (!membership) return null;
-  return { userId: row.userId, orgId: membership.orgId, email: row.email, role: membership.role };
+  return {
+    userId: row.userId,
+    orgId: membership.orgId,
+    email: row.email,
+    role: membership.role,
+    isAdmin: row.isAdmin,
+  };
 }
 
 export async function destroySession(sessionToken: string, db: Database = createDb()): Promise<void> {
@@ -138,4 +169,115 @@ export async function destroySession(sessionToken: string, db: Database = create
   await db.delete(sessions).where(eq(sessions.tokenHash, hash));
 }
 
+export interface PasswordLoginResult {
+  sessionToken: string;
+  userId: string;
+  orgId: string;
+  email: string;
+  isAdmin: boolean;
+}
+
+export async function loginWithPassword(
+  emailRaw: string,
+  password: string,
+  meta: { ipAddress?: string; userAgent?: string } = {},
+  db: Database = createDb(),
+): Promise<PasswordLoginResult> {
+  const email = emailRaw.trim().toLowerCase();
+  const [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+  if (!user || !user.passwordHash) {
+    throw new Error('invalid_credentials');
+  }
+  if (!verifyPassword(password, user.passwordHash)) {
+    throw new Error('invalid_credentials');
+  }
+  const [membership] = await db
+    .select()
+    .from(memberships)
+    .where(eq(memberships.userId, user.id))
+    .limit(1);
+  if (!membership) throw new Error('no_org_membership');
+
+  const sessionToken = randomToken(32);
+  await db.insert(sessions).values({
+    userId: user.id,
+    tokenHash: sha256(sessionToken),
+    expiresAt: new Date(Date.now() + SESSION_TTL_MS),
+    ipAddress: meta.ipAddress,
+    userAgent: meta.userAgent,
+  });
+  await db.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, user.id));
+
+  return {
+    sessionToken,
+    userId: user.id,
+    orgId: membership.orgId,
+    email: user.email,
+    isAdmin: user.isAdmin,
+  };
+}
+
+export interface SeedAdminInput {
+  email: string;
+  password: string;
+  name?: string;
+}
+
+export async function seedAdmin(
+  input: SeedAdminInput,
+  db: Database = createDb(),
+): Promise<{ created: boolean; userId: string; orgId: string }> {
+  const email = input.email.trim().toLowerCase();
+  const existing = (await db.select().from(users).where(eq(users.email, email)).limit(1))[0];
+
+  if (existing) {
+    const updates: Partial<typeof users.$inferInsert> = {};
+    if (!existing.isAdmin) updates.isAdmin = true;
+    if (!existing.passwordHash) updates.passwordHash = hashPassword(input.password);
+    if (!existing.emailVerified) updates.emailVerified = true;
+    if (input.name && !existing.name) updates.name = input.name;
+    if (Object.keys(updates).length > 0) {
+      await db.update(users).set(updates).where(eq(users.id, existing.id));
+    }
+    const [m] = await db
+      .select()
+      .from(memberships)
+      .where(eq(memberships.userId, existing.id))
+      .limit(1);
+    if (!m) {
+      // Has a user but no org — bootstrap one
+      const orgSlug = `admin-${randomToken(3).toLowerCase()}`;
+      const [org] = await db
+        .insert(organizations)
+        .values({ slug: orgSlug, name: `${input.name ?? 'Admin'} workspace`, plan: 'enterprise' })
+        .returning();
+      if (!org) throw new Error('org_create_failed');
+      await db.insert(memberships).values({ orgId: org.id, userId: existing.id, role: 'owner' });
+      return { created: false, userId: existing.id, orgId: org.id };
+    }
+    return { created: false, userId: existing.id, orgId: m.orgId };
+  }
+
+  const [user] = await db
+    .insert(users)
+    .values({
+      email,
+      emailVerified: true,
+      isAdmin: true,
+      name: input.name,
+      passwordHash: hashPassword(input.password),
+    })
+    .returning();
+  if (!user) throw new Error('user_create_failed');
+
+  const orgSlug = `admin-${randomToken(3).toLowerCase()}`;
+  const [org] = await db
+    .insert(organizations)
+    .values({ slug: orgSlug, name: `${input.name ?? 'Admin'} workspace`, plan: 'enterprise' })
+    .returning();
+  if (!org) throw new Error('org_create_failed');
+  await db.insert(memberships).values({ orgId: org.id, userId: user.id, role: 'owner' });
+  return { created: true, userId: user.id, orgId: org.id };
+}
+
 export const __test = { sha256, randomToken, slugify };