Add users and network settings tabs with admin protections.

List and delete accounts with last-admin and Administrators-group guards, and expose editable network settings via the configuration UI.

service/internal/auth/weak.go

@@ -0,0 +1,28 @@
+package auth
+
+import "strings"
+
+// Small denylist of common weak passwords (case-insensitive compare).
+var commonPasswords = map[string]struct{}{
+	"password":         {},
+	"password123":      {},
+	"password1234":     {},
+	"12345678901234":   {},
+	"qwertyuiopasdf":   {},
+	"admin":            {},
+	"adminadmin":       {},
+	"letmein":          {},
+	"welcome":          {},
+	"welcome123":       {},
+	"changeme":         {},
+	"changeme123":      {},
+	"cluster canvas":   {},
+	"clustercanvas":    {},
+	"correct horse battery staple": {},
+}
+
+func isCommonPassword(password string) bool {
+	normalized := strings.ToLower(strings.TrimSpace(password))
+	_, found := commonPasswords[normalized]
+	return found
+}