feat: migrate frontend to Astro + expand AI moderation + backend admin/runtime config

Frontend:
- migrate from Vite to Astro (astro.config.mjs, pages/, layouts/)
- add admin panel, settings page, command palette, error boundary
- refactor App.tsx, MascotChatbot, Sidebar, Header, DashboardLayout
- update API client, WebSocket, auth, dashboard features

Backend:
- add admin module and config routes
- refactor middlewares, Redis connection, WebSocket server/bridge
- add runtime config loader

Discord Gateway:
- refactor AI moderation: circuit breaker, concurrency limiter, fallback processor
- add media analysis client, Seaxng search, user profile learner
- add new drizzle migration

Shared:
- extend database schema, add new config fields

services/frontend/src/features/auth/index.tsx

@@ -1,7 +1,7 @@
 import { motion } from "framer-motion";
-import { Lock } from "lucide-react";
-import { useState } from "react";
-import { login } from "../../shared/api/client.js";
+import { Lock, Unlock, Shield, WifiOff, RefreshCw } from "lucide-react";
+import { useState, useCallback } from "react";
+import { login, setSessionToken } from "../../shared/api/client.js";
 import {
   Button,
   Card,
@@ -14,67 +14,148 @@ import {
 
 interface AuthOverlayProps {
   onAuthenticated: () => void;
+  isPublic: boolean;
+  configError?: string | null;
+  onRetryConfig?: () => void;
 }
 
-export function AuthOverlay({ onAuthenticated }: AuthOverlayProps) {
+export function AuthOverlay({
+  onAuthenticated,
+  isPublic,
+  configError,
+  onRetryConfig,
+}: AuthOverlayProps) {
   const [password, setPassword] = useState("");
   const [error, setError] = useState<string | null>(null);
   const [loading, setLoading] = useState(false);
+  const [isNetworkError, setIsNetworkError] = useState(false);
 
   const handleSubmit = async (e: { preventDefault: () => void }) => {
     e.preventDefault();
     setLoading(true);
     setError(null);
+    setIsNetworkError(false);
     try {
-      await login(password);
-      localStorage.setItem("admin-password", password);
+      const result = await login(password);
+      // Store session token (new auth method)
+      if (result.token) {
+        setSessionToken(result.token);
+      }
+      // Clean up legacy stored password from localStorage if it was there
+      // from a previous session (before JWT migration)
+      localStorage.removeItem("admin-password");
       onAuthenticated();
-    } catch {
-      setError("Invalid password");
+    } catch (err) {
+      const isNetwork =
+        err instanceof TypeError &&
+        (err.message === "Failed to fetch" ||
+          err.message.includes("NetworkError") ||
+          err.message.includes("network"));
+      setIsNetworkError(isNetwork);
+      setError(
+        isNetwork
+          ? "Cannot reach server — check your connection or try again."
+          : "Invalid password",
+      );
     } finally {
       setLoading(false);
     }
   };
 
+  // ── Retry config fetch (initial loading state) ──────────────────────────────
+  const [retryCount, setRetryCount] = useState(0);
+
+  const handleRetry = useCallback(() => {
+    setRetryCount((r) => r + 1);
+  }, []);
+
   return (
     <motion.div
       initial={{ opacity: 0, y: 20 }}
       animate={{ opacity: 1, y: 0 }}
       transition={{ duration: 0.4, ease: "easeOut" }}
-      className="flex items-center justify-center p-4"
+      className="flex min-h-screen items-center justify-center p-4"
     >
       <Card className="w-full max-w-md border-primary/30 shadow-lg shadow-primary/10">
         <CardHeader className="text-center">
           <div className="mx-auto mb-4 flex items-center justify-center">
             <div className="flex h-12 w-12 items-center justify-center rounded-full bg-primary/10 text-primary">
-              <Lock className="h-6 w-6" />
+              {isPublic ? (
+                <Shield className="h-6 w-6" />
+              ) : (
+                <Lock className="h-6 w-6" />
+              )}
             </div>
           </div>
-          <CardTitle>Admin Access Required</CardTitle>
+          <CardTitle>
+            {isPublic ? "Admin Authentication" : "Admin Access Required"}
+          </CardTitle>
           <CardDescription>
-            Enter the admin password to access Voice and Media controls.
+            {isPublic
+              ? "Enter the admin password to manage settings and perform administrative actions."
+              : "Enter the admin password to access the dashboard."}
           </CardDescription>
         </CardHeader>
         <CardContent>
+          {configError && (
+            <div className="mb-4 flex flex-col items-center gap-3 rounded-lg border border-amber-500/30 bg-amber-500/5 p-4 text-center">
+              <WifiOff className="h-6 w-6 text-amber-500" />
+              <p className="text-xs text-amber-600">{configError}</p>
+              {onRetryConfig && (
+                <Button
+                  onClick={onRetryConfig}
+                  variant="outline"
+                  size="sm"
+                  className="gap-2 border-amber-500/30 text-amber-600 hover:bg-amber-500/10"
+                >
+                  <RefreshCw className="h-3.5 w-3.5" />
+                  Retry Connection
+                </Button>
+              )}
+            </div>
+          )}
           <form onSubmit={handleSubmit} className="space-y-4">
             <div className="space-y-2">
               <Input
                 type="password"
-                placeholder="Enter password"
+                placeholder="Enter admin password"
                 value={password}
                 onChange={(e) => setPassword(e.target.value)}
                 autoFocus
               />
-              {error && <p className="text-xs text-destructive">{error}</p>}
+              {error && (
+                <div
+                  className={`flex items-start gap-2 rounded-lg p-2 text-xs ${
+                    isNetworkError
+                      ? "bg-amber-500/10 text-amber-600"
+                      : "text-destructive"
+                  }`}
+                >
+                  {isNetworkError ? (
+                    <WifiOff className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+                  ) : (
+                    <Lock className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+                  )}
+                  <span>{error}</span>
+                </div>
+              )}
             </div>
             <Button
               type="submit"
               className="w-full"
               disabled={loading || !password}
             >
-              {loading ? "Authenticating..." : "Unlock Controls"}
+              {loading ? "Authenticating..." : "Unlock"}
             </Button>
           </form>
+
+          {isPublic && (
+            <p className="mt-4 text-xs text-center text-muted-foreground">
+              <Unlock className="inline h-3 w-3 mr-1" />
+              The dashboard is in public mode — most data is visible without
+              authentication. Admin password is only needed for management actions.
+            </p>
+          )}
         </CardContent>
       </Card>
     </motion.div>