feat: add comprehensive REST API with token auth, OpenAPI docs, and full test coverage

- API token model (SHA-256 hashed, debounced lastUsedAt) with Bearer auth
- Dual auth middleware (session + API token) in src/lib/api-auth.ts
- 23 REST endpoints under /api/v1/ covering all functionality:
  tokens, proxy-hosts, l4-proxy-hosts, certificates, ca-certificates,
  client-certificates, access-lists, settings, instances, users,
  audit-log, caddy/apply
- OpenAPI 3.1 spec at /api/v1/openapi.json with fully typed schemas
- Swagger UI docs page at /api-docs in the dashboard
- API token management integrated into the Profile page
- Fix: next build now works under Node.js (bun:sqlite aliased to better-sqlite3)
- 89 new API route unit tests + 11 integration tests (592 total)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/v1/users/[id]/route.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireApiUser, requireApiAdmin, apiErrorResponse, ApiAuthError } from "@/src/lib/api-auth";
+import { getUserById, updateUserProfile } from "@/src/lib/models/user";
+
+function stripPasswordHash(user: Record<string, unknown>) {
+  const { password_hash, ...rest } = user;
+  return rest;
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    const auth = await requireApiUser(request);
+    const { id } = await params;
+    const targetId = Number(id);
+
+    // Non-admins can only view themselves
+    if (auth.role !== "admin" && auth.userId !== targetId) {
+      throw new ApiAuthError("Forbidden", 403);
+    }
+
+    const user = await getUserById(targetId);
+    if (!user) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+    return NextResponse.json(stripPasswordHash(user as unknown as Record<string, unknown>));
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  try {
+    await requireApiAdmin(request);
+    const { id } = await params;
+    const body = await request.json();
+    const user = await updateUserProfile(Number(id), body);
+    if (!user) {
+      return NextResponse.json({ error: "Not found" }, { status: 404 });
+    }
+    return NextResponse.json(stripPasswordHash(user as unknown as Record<string, unknown>));
+  } catch (error) {
+    return apiErrorResponse(error);
+  }
+}