feat: add visual admin panel with page builder and settings editor

- Add /admin route with password-protected visual page builder
- Page Builder: manage hero images, standalone albums, subpages, and sections
- Album Picker: browse all shared Immich albums with search and filtering
- Settings Editor: theme, grid, footer, legal, SEO configuration
- YAML service with atomic writes and automatic backups (content/.backups/)
- HMAC-signed admin sessions (24h expiry, HttpOnly cookies)
- API endpoints: /api/admin/{auth,gallery,settings,albums,reload}
- Enable with ADMIN_PASSWORD env var; disabled by default
- invalidateConfigCache() export for hot-reload after saves

app/api/admin/albums/route.ts

@@ -0,0 +1,67 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { getConfig } from '@/lib/config';
+
+interface ImmichAlbumSummary {
+  id: string;
+  albumName: string;
+  description: string;
+  albumThumbnailAssetId: string | null;
+  assetCount: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/** GET: List ALL shared Immich albums (not just allowlisted ones). */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const config = getConfig();
+  if (config.needsSetup) {
+    return NextResponse.json({ error: 'Immich not configured' }, { status: 503 });
+  }
+
+  try {
+    const res = await fetch(`${config.immich.apiUrl}/albums?shared=true`, {
+      headers: {
+        'x-api-key': config.immich.apiKey,
+        Accept: 'application/json',
+      },
+    });
+
+    if (!res.ok) {
+      return NextResponse.json({ error: `Immich API returned ${res.status}` }, { status: 502 });
+    }
+
+    const albums = (await res.json()) as ImmichAlbumSummary[];
+
+    // Mark which albums are already configured
+    const configuredIds = new Set(config.albums);
+    const enriched = albums.map((album) => ({
+      id: album.id,
+      albumName: album.albumName,
+      description: album.description || '',
+      thumbnailAssetId: album.albumThumbnailAssetId,
+      assetCount: album.assetCount,
+      createdAt: album.createdAt,
+      updatedAt: album.updatedAt,
+      isConfigured: configuredIds.has(album.id),
+    }));
+
+    // Sort: configured first, then by name
+    enriched.sort((a, b) => {
+      if (a.isConfigured !== b.isConfigured) return a.isConfigured ? -1 : 1;
+      return a.albumName.localeCompare(b.albumName);
+    });
+
+    return NextResponse.json({ albums: enriched });
+  } catch (err) {
+    console.error('[Admin] Failed to fetch albums from Immich:', err);
+    return NextResponse.json({ error: 'Failed to connect to Immich' }, { status: 502 });
+  }
+}

app/api/admin/auth/route.ts

@@ -0,0 +1,64 @@
+import { NextRequest, NextResponse } from 'next/server';
+import {
+  verifyAdminPassword,
+  createAdminToken,
+  isAdminAuthenticated,
+  isAdminEnabled,
+  COOKIE_NAME,
+  SESSION_DURATION_MS,
+} from '@/lib/admin/auth';
+
+/** POST: Login with admin password. */
+export async function POST(request: NextRequest) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json(
+      { error: 'Admin panel is not enabled. Set ADMIN_PASSWORD in your environment.' },
+      { status: 403 },
+    );
+  }
+
+  const body = await request.json().catch(() => null);
+  if (!body?.password || typeof body.password !== 'string') {
+    return NextResponse.json({ error: 'Password is required' }, { status: 400 });
+  }
+
+  if (!verifyAdminPassword(body.password)) {
+    return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
+  }
+
+  const token = createAdminToken();
+  const response = NextResponse.json({ success: true });
+
+  response.cookies.set(COOKIE_NAME, token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    path: '/',
+    maxAge: SESSION_DURATION_MS / 1000,
+  });
+
+  return response;
+}
+
+/** GET: Check session status. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ authenticated: false, enabled: false });
+  }
+
+  const authenticated = await isAdminAuthenticated();
+  return NextResponse.json({ authenticated, enabled: true });
+}
+
+/** DELETE: Logout. */
+export async function DELETE() {
+  const response = NextResponse.json({ success: true });
+  response.cookies.set(COOKIE_NAME, '', {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'strict',
+    path: '/',
+    maxAge: 0,
+  });
+  return response;
+}

app/api/admin/gallery/route.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { readGalleryYaml, writeGalleryYaml } from '@/lib/admin/yaml-service';
+import { invalidateConfigCache } from '@/lib/config';
+import type { GalleryYaml } from '@/lib/config/schema';
+
+/** GET: Read current gallery.yaml config. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const gallery = await readGalleryYaml();
+  return NextResponse.json({ gallery: gallery || { hero: [], albums: [], subpages: [] } });
+}
+
+/** PUT: Write gallery.yaml config. */
+export async function PUT(request: Request) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const body = await request.json().catch(() => null);
+  if (!body?.gallery) {
+    return NextResponse.json({ error: 'Missing gallery data' }, { status: 400 });
+  }
+
+  // Validate basic structure
+  const gallery = body.gallery as GalleryYaml;
+  if (!Array.isArray(gallery.hero) && typeof gallery.hero !== 'string' && gallery.hero != null) {
+    return NextResponse.json({ error: 'Invalid hero format' }, { status: 400 });
+  }
+
+  try {
+    await writeGalleryYaml(gallery);
+    invalidateConfigCache();
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    console.error('[Admin] Failed to write gallery.yaml:', err);
+    return NextResponse.json({ error: 'Failed to save gallery config' }, { status: 500 });
+  }
+}

app/api/admin/reload/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { invalidateConfigCache } from '@/lib/config';
+import { immich } from '@/lib/immich';
+
+/** POST: Force reload config and clear caches. */
+export async function POST() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  invalidateConfigCache();
+  immich.invalidateAll();
+
+  return NextResponse.json({ success: true, message: 'Config and cache reloaded' });
+}

app/api/admin/settings/route.ts

@@ -0,0 +1,44 @@
+import { NextResponse } from 'next/server';
+import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
+import { readSettingsYaml, writeSettingsYaml } from '@/lib/admin/yaml-service';
+import { invalidateConfigCache } from '@/lib/config';
+import type { SettingsYaml } from '@/lib/config/schema';
+
+/** GET: Read current settings.yaml config. */
+export async function GET() {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const settings = await readSettingsYaml();
+  return NextResponse.json({ settings: settings || {} });
+}
+
+/** PUT: Write settings.yaml config. */
+export async function PUT(request: Request) {
+  if (!isAdminEnabled()) {
+    return NextResponse.json({ error: 'Admin not enabled' }, { status: 403 });
+  }
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  const body = await request.json().catch(() => null);
+  if (!body?.settings) {
+    return NextResponse.json({ error: 'Missing settings data' }, { status: 400 });
+  }
+
+  const settings = body.settings as SettingsYaml;
+
+  try {
+    await writeSettingsYaml(settings);
+    invalidateConfigCache();
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    console.error('[Admin] Failed to write settings.yaml:', err);
+    return NextResponse.json({ error: 'Failed to save settings' }, { status: 500 });
+  }
+}