Fix/dashboard auth clear stale cookies

Cargo.toml

@@ -3,7 +3,7 @@ members = ["clients/rust-client", "sdbql-core", "benchmarks"]
 
 [package]
 name = "solidb"
-version = "0.26.0"
+version = "0.26.2"
 edition = "2021"
 default-run = "solidb"
 description = "A lightweight, high-performance structured database server written in Rust."
@@ -19,6 +19,9 @@ tokio = { version = "1.35", features = ["full"] }
 
 # HTTP server
 axum = { version = "0.8.7", features = ["multipart", "ws", "macros"] }
+# Drive HTTP connections manually (instead of `axum::serve`) so we can set an
+# HTTP/1 header-read timeout — see the multiplexed HTTP server in main.rs.
+hyper-util = { version = "0.1", features = ["server-auto", "server-graceful", "service", "tokio", "http1", "http2"] }
 tower = { version = "0.5.2", features = ["util"] }
 tower-http = { version = "0.6.8", features = ["trace", "cors", "compression-gzip", "compression-zstd"] }
 async-stream = "0.3"

admin/.env.test

@@ -0,0 +1,22 @@
+# Test environment -- `soli test` reads this instead of .env.
+# Use a dedicated database so tests don't touch development data; the test
+# runner drops & recreates this database per worker on each run.
+
+# 127.0.0.1, not localhost: see .env.
+SOLIDB_HOST=http://127.0.0.1:6745
+SOLIDB_DATABASE=solidb_admin_test
+SOLIDB_USERNAME=admin
+SOLIDB_PASSWORD=admin
+
+# HTTP.request()'s SSRF guard blocks loopback; the specs exercise the real
+# local SoliDB API, so allow it (same as .env).
+SOLI_DEV_ALLOW_SSRF=1
+
+# The test client and the test server are colocated and trusted; the Origin
+# check would reject every POST otherwise.
+SOLI_DISABLE_CSRF=true
+
+# .env sets a LAN SOLIDB_PUBLIC_WS_URL for remote browsers; it leaks into the
+# test process env. Force it empty so public_ws_url() derives from SOLIDB_HOST
+# (blank counts as unset).
+SOLIDB_PUBLIC_WS_URL=

admin/.gitignore

@@ -0,0 +1,34 @@
+# Dependencies
+node_modules/
+
+# Build artifacts
+/target/
+*.o
+*.so
+
+# Process files
+*.pid
+
+# Logs
+*.log
+logs/
+
+# Environment
+.env
+.env.local
+.env.*.local
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Coverage
+coverage/
+.coverage

admin/AGENTS.md

@@ -0,0 +1,5 @@
+# AGENTS.md
+
+This project's agent guidance lives in `CLAUDE.md` (root) and per-directory `CLAUDE.md` files under `app/`, `tests/`, and `db/migrations/`. They apply to all coding agents — Claude Code, Cursor, Aider, Copilot CLI, Codex CLI, etc.
+
+Start by reading `CLAUDE.md`. The "For AI agents — read this first" section at the top is the contract: verification loop, generator-first, footguns.