Add users and network settings tabs with admin protections.

List and delete accounts with last-admin and Administrators-group guards, and expose editable network settings via the configuration UI.

service/internal/settings/setup.go

@@ -0,0 +1,35 @@
+package settings
+
+import (
+	"errors"
+	"os"
+	"strings"
+)
+
+// IsSetupCompleted reports whether first-run setup has finished.
+func IsSetupCompleted(dir string) (bool, error) {
+	payload, err := LoadSettings(dir)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return false, nil
+		}
+		return false, err
+	}
+	return payload.SetupCompleted, nil
+}
+
+// EffectiveNetwork returns network settings with defaults applied.
+func EffectiveNetwork(network NetworkSettings) NetworkSettings {
+	defaults := DefaultNetworkSettings()
+	if network.ListenAddress == "" {
+		network.ListenAddress = defaults.ListenAddress
+	}
+	network.PublicHostname = strings.TrimSpace(network.PublicHostname)
+	if network.AccessMode == "" {
+		network.AccessMode = defaults.AccessMode
+	}
+	if network.Rules == nil {
+		network.Rules = []string{}
+	}
+	return network
+}