Add the admin page (phase 3)

services/admin is a client of the content service's HTTP API, served on
the tailnet only. It renders on the server with plain forms and no client
scripts, and holds the admin token so the browser never sees it.

- Review queue: reasons, line diff against the live version, accept,
  reject, and reject with the live version put back into Obsidian
- Notes and drafts: search, preview, fields, backlinks, publish toggle
- History with compare and roll back
- Quick capture for a status or a Library item (optionally both)
- Store: orders open or closed per category, open slots and stock
- Overview: counts, last scan and error, scan now, sync job health
- Same-origin check on every post, strict CSP, sanitized previews

The content service gains /api/status, sync run reports (/api/syncs) and
lookup of a note by name.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aSbo2D1qP8cMFQCykf7kx

services/admin/test/units.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from "vitest";
+import { diffLines } from "../src/diff.ts";
+import { html, raw } from "../src/html.ts";
+import { renderMarkdown } from "../src/markdown.ts";
+
+const md = (s: string) => renderMarkdown(s, { noteHref: (n) => `/go?name=${encodeURIComponent(n)}`, imageSrc: (f) => `/attachments/${f}` });
+
+describe("diff", () => {
+  it("marks added and removed lines and folds the rest", () => {
+    const before = ["a", "b", "c", "d", "e", "f", "g", "h", "i", "j"].join("\n");
+    const after = ["a", "b", "c", "d", "e", "F", "g", "h", "i", "j"].join("\n");
+    const d = diffLines(before, after, 1);
+    expect(d).toEqual([
+      { kind: "skip", count: 4 },
+      { kind: "same", text: "e" },
+      { kind: "remove", text: "f" },
+      { kind: "add", text: "F" },
+      { kind: "same", text: "g" },
+      { kind: "skip", count: 3 },
+    ]);
+  });
+
+  it("shows a new note as all added", () => {
+    expect(diffLines("", "x\ny")).toEqual([
+      { kind: "add", text: "x" },
+      { kind: "add", text: "y" },
+    ]);
+  });
+});
+
+describe("html", () => {
+  it("escapes values but not nested html", () => {
+    expect(html`<p>${"<b>"}${html`<i>${"&"}</i>`}${raw("<hr>")}</p>`.toString()).toBe("<p>&lt;b&gt;<i>&amp;</i><hr></p>");
+  });
+});
+
+describe("draft previews", () => {
+  it("never lets a draft run script", () => {
+    const out = md('<script>alert(1)</script>\n\n[x](javascript:alert(1)) <img src=x onerror=alert(1)>');
+    expect(out).not.toMatch(/<script|<img src=x|javascript:/i);
+    expect(out).toContain("&lt;script&gt;");
+  });
+
+  it("turns wikilinks and embeds into links and images", () => {
+    const out = md("See [[Mistborn|the book]] and ![[cover.png]].");
+    expect(out).toContain('<a href="/go?name=Mistborn"');
+    expect(out).toContain("the book</a>");
+    expect(out).toContain('<img src="/attachments/cover.png"');
+  });
+});