feat: public platform, admin console, templates, landing docs

Projects become publicly browsable after admin approval; management and
secret-adjacent reads (logs, variables, exec, connection URLs) require
owner/member/admin auth, and platform controls sit behind RequireAdmin.

- Backend: OptionalAuth middleware, read/authed/admin route groups,
  projects.is_approved + service_templates.owner_id migration,
  visibility-aware sqlc queries, admin overview/users/approval endpoints,
  EnsureAdminAccount bootstrap (ADMIN_* env), 30 seeded templates with
  owner CRUD, managed-database connection URLs gated owner+admin, fix
  DB.Stats() infinite recursion.
- Frontend: expandable persisted sidebar + clickable user menu, public
  landing page with searchable docs browser (GitHub sync, bundled
  snapshot + localStorage fallback), DocsBrowser shared with /docs,
  template create/edit/JSON-upload for owned templates, database create
  dialog, admin console (stats, approvals, project edit/delete, user
  admin toggles), HA/Security/Usage polish with dead CSS tokens mapped
  to real theme vars, anonymous-safe gating on every mutation control.
- Tests: safe window.localStorage access fixes happy-dom crashes in
  PlatformShell and canvas storage.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/api/scaling.go

@@ -24,31 +24,39 @@ func NewScalingHandler(autoScaler *scaling.AutoScaler) *ScalingHandler {
 	}
 }
 
-// RegisterRoutes registers scaling routes
-func (h *ScalingHandler) RegisterRoutes(router *gin.RouterGroup) {
+// RegisterReadRoutes registers public scaling read endpoints.
+func (h *ScalingHandler) RegisterReadRoutes(router *gin.RouterGroup) {
 	scaling := router.Group("/scaling")
 	{
 		scaling.GET("/policies", h.GetScalingPolicies)
-		scaling.POST("/policies", h.SetScalingPolicy)
 		scaling.GET("/policies/:serviceId", h.GetScalingPolicy)
-		scaling.PUT("/policies/:serviceId", h.UpdateScalingPolicy)
-		scaling.DELETE("/policies/:serviceId", h.DeleteScalingPolicy)
 
 		scaling.GET("/services", h.GetServiceStates)
 		scaling.GET("/services/:serviceId", h.GetServiceState)
 		scaling.GET("/services/:serviceId/history", h.GetScalingHistory)
 
-		scaling.POST("/services/:serviceId/scale", h.ManualScale)
-
 		scaling.GET("/status", h.GetScalingStatus)
-		scaling.POST("/enable", h.EnableAutoScaler)
-		scaling.POST("/disable", h.DisableAutoScaler)
 
 		scaling.GET("/metrics", h.GetScalingMetrics)
 		scaling.GET("/events", h.GetScalingEvents)
 	}
 }
 
+// RegisterAdminRoutes registers scaling mutation endpoints.
+func (h *ScalingHandler) RegisterAdminRoutes(router *gin.RouterGroup) {
+	scaling := router.Group("/scaling")
+	{
+		scaling.POST("/policies", h.SetScalingPolicy)
+		scaling.PUT("/policies/:serviceId", h.UpdateScalingPolicy)
+		scaling.DELETE("/policies/:serviceId", h.DeleteScalingPolicy)
+
+		scaling.POST("/services/:serviceId/scale", h.ManualScale)
+
+		scaling.POST("/enable", h.EnableAutoScaler)
+		scaling.POST("/disable", h.DisableAutoScaler)
+	}
+}
+
 // GetScalingPolicies returns all scaling policies
 func (h *ScalingHandler) GetScalingPolicies(c *gin.Context) {
 	states := h.autoScaler.GetAllServiceStates()