Add multi-user auth system and admin panel

- User model with email/hashed_password/is_admin/notification_prefs
- JWT auth: POST /api/auth/register, /login, /me
- First registered user auto-promoted to admin
- Migration 0005: users table + user_id FK on follows (clears global follows)
- Follows, dashboard, settings, admin endpoints all require authentication
- Admin endpoints (settings writes, celery triggers) require is_admin
- Frontend: login/register pages, Zustand auth store (localStorage persist)
- AuthGuard component gates all app routes, shows app shell only when authed
- Sidebar shows user email + logout; Admin nav link visible to admins only
- Admin panel (/settings): user list with delete + promote/demote, LLM config,
  data source settings, and manual celery controls

Authored-By: Jack Levy

frontend/components/shared/AuthGuard.tsx

@@ -0,0 +1,49 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { usePathname, useRouter } from "next/navigation";
+import { useAuthStore } from "@/stores/authStore";
+import { Sidebar } from "./Sidebar";
+
+const PUBLIC_PATHS = ["/login", "/register"];
+
+export function AuthGuard({ children }: { children: React.ReactNode }) {
+  const router = useRouter();
+  const pathname = usePathname();
+  const token = useAuthStore((s) => s.token);
+  // Zustand persist hydrates asynchronously — wait for it before rendering
+  const [hydrated, setHydrated] = useState(false);
+
+  useEffect(() => {
+    setHydrated(true);
+  }, []);
+
+  useEffect(() => {
+    if (!hydrated) return;
+    if (!token && !PUBLIC_PATHS.includes(pathname)) {
+      router.replace("/login");
+    }
+  }, [hydrated, token, pathname, router]);
+
+  if (!hydrated) return null;
+
+  // Public pages (login/register) render without the app shell
+  if (PUBLIC_PATHS.includes(pathname)) {
+    return <>{children}</>;
+  }
+
+  // Not logged in yet — blank while redirecting
+  if (!token) return null;
+
+  // Authenticated: render the full app shell
+  return (
+    <div className="flex h-screen bg-background">
+      <Sidebar />
+      <main className="flex-1 overflow-auto">
+        <div className="container mx-auto px-6 py-6 max-w-7xl">
+          {children}
+        </div>
+      </main>
+    </div>
+  );
+}

frontend/components/shared/Sidebar.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import Link from "next/link";
-import { usePathname } from "next/navigation";
+import { usePathname, useRouter } from "next/navigation";
 import {
   LayoutDashboard,
   FileText,
@@ -10,21 +10,34 @@ import {
   Heart,
   Settings,
   Landmark,
+  LogOut,
 } from "lucide-react";
+import { useQueryClient } from "@tanstack/react-query";
 import { cn } from "@/lib/utils";
 import { ThemeToggle } from "./ThemeToggle";
+import { useAuthStore } from "@/stores/authStore";
 
 const NAV = [
-  { href: "/", label: "Dashboard", icon: LayoutDashboard },
-  { href: "/bills", label: "Bills", icon: FileText },
-  { href: "/members", label: "Members", icon: Users },
-  { href: "/topics", label: "Topics", icon: Tags },
-  { href: "/following", label: "Following", icon: Heart },
-  { href: "/settings", label: "Settings", icon: Settings },
+  { href: "/", label: "Dashboard", icon: LayoutDashboard, adminOnly: false },
+  { href: "/bills", label: "Bills", icon: FileText, adminOnly: false },
+  { href: "/members", label: "Members", icon: Users, adminOnly: false },
+  { href: "/topics", label: "Topics", icon: Tags, adminOnly: false },
+  { href: "/following", label: "Following", icon: Heart, adminOnly: false },
+  { href: "/settings", label: "Admin", icon: Settings, adminOnly: true },
 ];
 
 export function Sidebar() {
   const pathname = usePathname();
+  const router = useRouter();
+  const qc = useQueryClient();
+  const user = useAuthStore((s) => s.user);
+  const logout = useAuthStore((s) => s.logout);
+
+  function handleLogout() {
+    logout();
+    qc.clear();
+    router.replace("/login");
+  }
 
   return (
     <aside className="w-56 shrink-0 border-r border-border bg-card flex flex-col">
@@ -34,7 +47,7 @@ export function Sidebar() {
       </div>
 
       <nav className="flex-1 p-3 space-y-1">
-        {NAV.map(({ href, label, icon: Icon }) => {
+        {NAV.filter(({ adminOnly }) => !adminOnly || user?.is_admin).map(({ href, label, icon: Icon }) => {
           const active = href === "/" ? pathname === "/" : pathname.startsWith(href);
           return (
             <Link
@@ -54,9 +67,25 @@ export function Sidebar() {
         })}
       </nav>
 
-      <div className="p-3 border-t border-border flex items-center justify-between">
-        <span className="text-xs text-muted-foreground">Theme</span>
-        <ThemeToggle />
+      <div className="p-3 border-t border-border space-y-2">
+        {user && (
+          <div className="flex items-center justify-between">
+            <span className="text-xs text-muted-foreground truncate max-w-[120px]" title={user.email}>
+              {user.email}
+            </span>
+            <button
+              onClick={handleLogout}
+              className="p-1 rounded-md text-muted-foreground hover:text-foreground hover:bg-accent"
+              title="Sign out"
+            >
+              <LogOut className="w-3.5 h-3.5" />
+            </button>
+          </div>
+        )}
+        <div className="flex items-center justify-between">
+          <span className="text-xs text-muted-foreground">Theme</span>
+          <ThemeToggle />
+        </div>
       </div>
     </aside>
   );