feat(hub): migrate database admin pages to SPA (database-admin)

- scaffold hub/database-admin as SvelteKit 2 + Svelte 5 static SPA
  with aurora/glass visual style (paths.base='/database')
- add lib/{api,session,org}.ts + Aurora.svelte component
- add routes: root redirect, /admin login page, /dashboard (OWNER/ADMIN only)
- backend: replace server-rendered HTML routes with /database/config JSON endpoint
- add hub/src/database/static.ts to serve SPA under /database/*
- wire registerDatabaseSpa into plugin.ts
- exempt /database/* from silo rate-limit (same treatment as /admin/*)
- add database:dev + database:build npm scripts; update deploy scripts
- update hub/src/database/README.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hub/database-admin/src/lib/api.ts

@@ -0,0 +1,76 @@
+/**
+ * Thin API client for the database-admin backend. Same-origin cookie auth,
+ * reusing the platform session (`cph_session`) and the admin plane's /api/me.
+ */
+
+export class ApiError extends Error {
+	code: string;
+	status: number;
+	constructor(code: string, message: string, status: number) {
+		super(message);
+		this.name = 'ApiError';
+		this.code = code;
+		this.status = status;
+	}
+}
+
+async function request(method: string, url: string, body?: unknown): Promise<unknown> {
+	const init: RequestInit = {
+		method,
+		credentials: 'same-origin',
+		headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+		body: body !== undefined ? JSON.stringify(body) : undefined,
+	};
+	const res = await fetch(url, init);
+	const text = await res.text();
+	let data: unknown = null;
+	if (text !== '') {
+		try {
+			data = JSON.parse(text);
+		} catch {
+			data = text;
+		}
+	}
+	if (!res.ok) {
+		const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
+		throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
+	}
+	return data;
+}
+
+const get = (u: string) => request('GET', u);
+const post = (u: string, b?: unknown) => request('POST', u, b);
+
+// --- Types ---
+
+export interface OrgMembership {
+	id: string;
+	slug: string;
+	name: string;
+	status: string;
+	role: 'OWNER' | 'ADMIN' | 'MEMBER';
+}
+
+export interface MeResponse {
+	user: {
+		id: string;
+		feishuOpenId: string;
+		displayName: string;
+		avatarUrl: string | null;
+	};
+	organizations: OrgMembership[];
+}
+
+/** Unauthenticated bootstrap the login page needs: which org to OAuth against + dev toggle. */
+export interface DatabaseConfig {
+	siloOrganizationSlug: string;
+	devLoginEnabled: boolean;
+}
+
+// --- API ---
+
+export const api = {
+	me: () => get('/api/me') as Promise<MeResponse>,
+	logout: () => post('/auth/logout'),
+	databaseConfig: () => get('/database/config') as Promise<DatabaseConfig>,
+};

hub/database-admin/src/lib/components/Aurora.svelte

@@ -0,0 +1,6 @@
+<!-- Animated aurora background blobs, shared by both pages (soft pastels on light). -->
+<div class="pointer-events-none fixed inset-0 overflow-hidden">
+	<div class="aurora absolute -left-32 -top-32 h-96 w-96 rounded-full bg-violet-300/50"></div>
+	<div class="aurora absolute right-0 top-1/4 h-96 w-96 rounded-full bg-cyan-300/40" style="animation-delay:-6s"></div>
+	<div class="aurora absolute bottom-0 left-1/3 h-96 w-96 rounded-full bg-indigo-300/40" style="animation-delay:-12s"></div>
+</div>

hub/database-admin/src/lib/org.ts

@@ -0,0 +1,7 @@
+import type { OrgMembership } from './api';
+
+export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
+	if (!org) return false;
+	const role = String(org.role ?? '').toUpperCase();
+	return role === 'OWNER' || role === 'ADMIN';
+}

hub/database-admin/src/lib/session.ts

@@ -0,0 +1,58 @@
+import { writable } from 'svelte/store';
+import { goto } from '$app/navigation';
+import { base } from '$app/paths';
+import { api, type MeResponse } from './api';
+
+interface SessionState {
+	loading: boolean;
+	me: MeResponse | null;
+	error: string | null;
+}
+
+export const session = writable<SessionState>({
+	loading: true,
+	me: null,
+	error: null,
+});
+
+export async function loadSession(): Promise<void> {
+	session.update((s) => ({ ...s, loading: true, error: null }));
+	try {
+		const me = await api.me();
+		session.set({ loading: false, me, error: null });
+	} catch (err) {
+		const status = (err as { status?: number }).status;
+		if (status === 401) {
+			session.set({ loading: false, me: null, error: null });
+			void redirectToLogin();
+			return;
+		}
+		session.set({
+			loading: false,
+			me: null,
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
+/**
+ * Send the browser to the login page (`/database/admin`). Unlike admin-web we
+ * don't jump straight to Feishu OAuth: the login page reads /database/config
+ * to build the org-scoped link and to show the dev bypass when enabled.
+ */
+export async function redirectToLogin(): Promise<void> {
+	const loginPath = `${base}/admin`;
+	if (window.location.pathname === loginPath) return;
+	await goto(loginPath, { replaceState: true });
+}
+
+/** Build the org-scoped Feishu OAuth entry point (a backend route, not under base). */
+export function feishuLoginHref(orgSlug: string, returnTo: string = `${base}/dashboard`): string {
+	return `/auth/feishu/${encodeURIComponent(orgSlug)}?returnTo=${encodeURIComponent(returnTo)}`;
+}
+
+export async function logout(): Promise<void> {
+	await api.logout();
+	session.set({ loading: false, me: null, error: null });
+	await redirectToLogin();
+}