Add admin dashboard, Umami beacon, README

app.py

@@ -363,6 +363,58 @@ def poll_provisioning():
     return ok, failed
 
 
+# ---------- admin ----------
+ADMIN_PASSWORD = CFG.get("admin_password", "czapiewski")
+
+
+@app.route("/admin", methods=["GET", "POST"])
+def admin():
+    if request.method == "POST":
+        if request.form.get("password") == ADMIN_PASSWORD:
+            session["admin"] = True
+        else:
+            flash("Bad admin password.", "warn")
+    if not session.get("admin"):
+        return render_template("admin_login.html")
+    d = db.get_db()
+    stats = {
+        "users": d.execute("SELECT COUNT(*) c FROM users").fetchone()["c"],
+        "active": d.execute("SELECT COUNT(*) c FROM users WHERE active=1").fetchone()["c"],
+        "revenue_sats": d.execute("SELECT COALESCE(SUM(amount_sats),0) s FROM orders WHERE status='paid'").fetchone()["s"],
+        "pending_orders": d.execute("SELECT COUNT(*) c FROM orders WHERE status='pending'").fetchone()["c"],
+        "gb_sold": d.execute("SELECT COALESCE(SUM(gb),0) s FROM plans WHERE id IN "
+                             "(SELECT plan_id FROM orders WHERE status='paid')").fetchone()["s"],
+    }
+    users = [dict(r) for r in d.execute("SELECT id,username,active,balance_gb,country,city,created_at "
+                                        "FROM users ORDER BY id DESC LIMIT 50")]
+    orders = [dict(r) for r in d.execute("SELECT * FROM orders ORDER BY id DESC LIMIT 20")]
+    deds = [dict(r) for r in d.execute("SELECT * FROM dedicated_ips ORDER BY id DESC LIMIT 30")]
+    d.close()
+    try:
+        ipr_balance = iproyal.get_balance()
+    except Exception:
+        ipr_balance = "unavailable"
+    return render_template("admin.html", stats=stats, users=users, orders=orders,
+                           dedicated=deds, ipr_balance=ipr_balance)
+
+
+@app.route("/admin/credit", methods=["POST"])
+def admin_credit():
+    if not session.get("admin"):
+        abort(403)
+    username = request.form.get("username", "").strip()
+    try:
+        gb = float(request.form.get("gb", 0))
+    except ValueError:
+        gb = 0
+    d = db.get_db()
+    d.execute("UPDATE users SET balance_gb=balance_gb+?, active=1 WHERE username=?", (gb, username))
+    d.commit()
+    d.close()
+    flash(f"Credited {gb} GB to {username}", "ok")
+    return redirect(url_for("admin"))
+
+
 # ---------- agent discovery ----------
 @app.route("/llms.txt")
 def llms_txt():