server: a non-admin account can manage its own uploads

Signing in and being allowed to administer the server were the same
question: the OIDC callback refused a session outright to anyone outside
the admin group. A legitimate user could authenticate, be told what they
could not do, and be left with no way to see or delete the data their own
devices had uploaded.

They are separate questions now. Everyone who authenticates gets a
session; the admin flag rides inside the MAC'd payload, so promoting
yourself means forging a signature rather than editing a cookie, and a
role that does not parse fails closed to "user".

Pages scope themselves through visibleDevices/mayTouchRun rather than
filtering individually — per-page scoping is what the next page added
will be missing, and that failure is silent, since a listing that leaks
other people's uploads looks exactly like one that does not. Someone
else's run answers 404, not 403: a distinguishable refusal would confirm
the run exists. Revoking devices and minting enrolment tokens affect the
whole server and stay behind adminOnly at the route table, where someone
looking for who-may-do-what will actually find it.

Ownership is re-read per request instead of captured at sign-in, so
unlinking an account takes effect immediately rather than at session
expiry. Tests cover that, plus the degenerate case of an empty subject,
which must own nothing rather than everything with an empty account id.

Also: attribute the ICMPv6 finding per network. It compared "is IPv6
configured anywhere on this device" against "did any network answer",
which on a phone reports IPv6-is-broken about a network where IPv6 was
never configured. network_ref is null on every test, so the probe now
records per-network outcomes structurally rather than as prose a finding
would have to parse.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/adminauth/adminauth.go

@@ -166,12 +166,21 @@ func (t *Throttle) Succeeded() {
 
 // ---- sessions ---------------------------------------------------------------------------
 
-// Session is an authenticated admin, however they proved it.
+// Session is an authenticated account, however it proved itself. Not necessarily an admin:
+// signing in and being allowed to administer the server are separate questions, and a plain user
+// gets a session so they can manage their own uploads.
 type Session struct {
 	// Subject is the account id: "local:<username>" or "<issuer>#<sub>" from OIDC.
 	Subject string
 	// Display is what the UI shows.
 	Display string
+	// Admin is authorisation, decided at sign-in and carried inside the signed payload.
+	//
+	// Inside, specifically — not derived later from the subject, and not stored beside the MAC.
+	// A flag outside the signature is a privilege escalation anyone can perform with a text
+	// editor, and re-deriving it per request would mean re-reading group membership from the IdP
+	// on a path that has no token to do it with.
+	Admin   bool
 	Expires time.Time
 }
 
@@ -203,12 +212,16 @@ func NewSecret() ([]byte, error) {
 
 var ErrSession = errors.New("session is not valid")
 
-// Issue returns the cookie value for a newly authenticated admin.
-func (s *Sessions) Issue(subject, display string) string {
+// Issue returns the cookie value for a newly authenticated account.
+func (s *Sessions) Issue(subject, display string, admin bool) string {
 	exp := time.Now().Add(s.ttl).Unix()
+	role := "u"
+	if admin {
+		role = "a"
+	}
 	payload := base64.RawURLEncoding.EncodeToString([]byte(subject)) + "." +
 		base64.RawURLEncoding.EncodeToString([]byte(display)) + "." +
-		strconv.FormatInt(exp, 10)
+		strconv.FormatInt(exp, 10) + "." + role
 	return payload + "." + s.mac(payload)
 }
 
@@ -225,7 +238,7 @@ func (s *Sessions) Parse(value string) (*Session, error) {
 		return nil, ErrSession
 	}
 	parts := strings.Split(payload, ".")
-	if len(parts) != 3 {
+	if len(parts) != 4 {
 		return nil, ErrSession
 	}
 	subject, err := base64.RawURLEncoding.DecodeString(parts[0])
@@ -243,7 +256,13 @@ func (s *Sessions) Parse(value string) (*Session, error) {
 	if time.Now().After(time.Unix(exp, 0)) {
 		return nil, fmt.Errorf("%w: expired", ErrSession)
 	}
-	return &Session{Subject: string(subject), Display: string(display), Expires: time.Unix(exp, 0)}, nil
+	// Anything that is not exactly the admin marker is a user. A malformed role must fail closed:
+	// the safe reading of an unparseable privilege claim is the smaller privilege.
+	admin := parts[3] == "a"
+	return &Session{
+		Subject: string(subject), Display: string(display),
+		Admin: admin, Expires: time.Unix(exp, 0),
+	}, nil
 }
 
 func (s *Sessions) mac(payload string) string {