feat: optional 4-digit PIN asked in every new tab (not on reload), on-screen keypad for phones; set, change or remove it in the account; five misses sign out

internal/server/db.go

@@ -119,6 +119,7 @@ CREATE TABLE IF NOT EXISTS forward_rules (
 		`ALTER TABLE forward_rules ADD COLUMN label TEXT NOT NULL DEFAULT ''`,
 		`ALTER TABLE admins ADD COLUMN password_off INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE agents ADD COLUMN transport TEXT NOT NULL DEFAULT 'auto'`,
+		`ALTER TABLE admins ADD COLUMN pin_hash TEXT NOT NULL DEFAULT ''`,
 	} {
 		if _, err := db.sql.Exec(alter); err != nil && !strings.Contains(err.Error(), "duplicate column") {
 			return err
@@ -256,6 +257,18 @@ func (db *DB) PasswordOff(adminID int64) bool {
 	return off == 1 && db.CountAdminKeys(adminID) > 0
 }
 
+// AdminPin is the hash of the admin's PIN, "" when there is none.
+func (db *DB) AdminPin(adminID int64) string {
+	var h string
+	_ = db.sql.QueryRow(`SELECT pin_hash FROM admins WHERE id = ?`, adminID).Scan(&h)
+	return h
+}
+
+func (db *DB) SetAdminPin(adminID int64, pinHash string) error {
+	_, err := db.sql.Exec(`UPDATE admins SET pin_hash = ? WHERE id = ?`, pinHash, adminID)
+	return err
+}
+
 func (db *DB) SetAdminPassword(adminID int64, passHash string) error {
 	_, err := db.sql.Exec(`UPDATE admins SET pass_hash = ? WHERE id = ?`, passHash, adminID)
 	return err