Add users and network settings tabs with admin protections.

List and delete accounts with last-admin and Administrators-group guards, and expose editable network settings via the configuration UI.

service/internal/api/groups_handlers.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
-	"os"
 	"strings"
 
 	"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
@@ -103,6 +102,13 @@ func groupsDeleteHandler(configDir string) http.HandlerFunc {
 			return
 		}
 
+		if name == settings.AdministratorsGroupName {
+			writeJSON(writer, http.StatusConflict, apiErrorResponse{
+				Error: "Administrators group cannot be deleted",
+			})
+			return
+		}
+
 		settingsPayload, err := loadSettingsOrDefault(configDir)
 		if err != nil {
 			writeJSON(writer, http.StatusInternalServerError, apiErrorResponse{Error: err.Error()})
@@ -136,20 +142,6 @@ func authorizeGroupsWrite(_ *http.Request) error {
 	return nil
 }
 
-func loadSettingsOrDefault(configDir string) (settings.Settings, error) {
-	payload, err := settings.LoadSettings(configDir)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return settings.Settings{Groups: []settings.Group{}}, nil
-		}
-		return settings.Settings{}, err
-	}
-	if payload.Groups == nil {
-		payload.Groups = []settings.Group{}
-	}
-	return payload, nil
-}
-
 func validateGroup(group settings.Group) error {
 	if strings.TrimSpace(group.Name) == "" {
 		return errors.New("group.name is required")