feat(hub): add Feishu OAuth session for org admin

Introduce signed cookie sessions, Feishu web OAuth, requireOrgRole
guards, and the first org admin APIs (summary + project settings).

hub/src/server.ts

@@ -1,5 +1,5 @@
 /**
- * Hub entry — Fastify server + Feishu WebSocket listener.
+ * Hub entry — Fastify server + Feishu WebSocket listener + org admin HTTP.
  *
  * Wires the full trigger path: lark ws receives `im.message.receive_v1` →
  * trigger handler resolves chat->project (ADR-0001), creates AgentRun + acquires
@@ -7,11 +7,15 @@
  * (ADR-0017), and releases the lock on finish. Feishu context reads inside the
  * loop are ADR-0003-authorized (chat must match binding).
  *
+ * Org admin (ADR-0021): Feishu OAuth session + `/api/org/:orgSlug/*`.
+ *
  * Env (see .env.example):
- *  DATABASE_URL, ANTHROPIC_AUTH_TOKEN, FEISHU_APP_ID/SECRET/BOT_OPEN_ID, PORT
+ *  DATABASE_URL, ANTHROPIC_AUTH_TOKEN, FEISHU_APP_ID/SECRET/BOT_OPEN_ID, PORT,
+ *  HUB_PROJECT_WORKSPACE_ROOT, HUB_SESSION_SECRET, HUB_PUBLIC_BASE_URL
  */
 import "dotenv/config";
 import Fastify from "fastify";
+import { registerAdminPlugin } from "./admin/plugin.js";
 import { prisma } from "./db.js";
 import { createEnvRuntimeSettings } from "./settings/runtime.js";
 import { createLarkClient, startFeishuListenerWithClient } from "./feishu/client.js";
@@ -44,6 +48,8 @@ async function main(): Promise<void> {
   const feishuAppSecret = requireEnv("FEISHU_APP_SECRET");
   const feishuBotOpenId = requireEnv("FEISHU_BOT_OPEN_ID");
   const projectWorkspaceRoot = requireEnv("HUB_PROJECT_WORKSPACE_ROOT");
+  const sessionSecret = requireEnv("HUB_SESSION_SECRET");
+  const publicBaseUrl = process.env["HUB_PUBLIC_BASE_URL"] ?? "http://127.0.0.1:8788";
   const port = Number(process.env["PORT"] ?? "8788");
 
   const app = Fastify({ logger: true });
@@ -58,6 +64,15 @@ async function main(): Promise<void> {
 
   app.get("/api/healthz", async () => ({ ok: true, ts: Date.now() }));
 
+  await registerAdminPlugin(app, {
+    prisma,
+    sessionSecret,
+    publicBaseUrl,
+    feishuAppId,
+    feishuAppSecret,
+    projectWorkspaceRoot,
+  });
+
   // --- Feishu listener ---
   const feishuListenerEnabled = booleanEnv("HUB_FEISHU_LISTENER_ENABLED", true);
   if (feishuListenerEnabled) {