feat: optional 4-digit PIN asked in every new tab (not on reload), on-screen keypad for phones; set, change or remove it in the account; five misses sign out

internal/server/server.go

@@ -61,6 +61,7 @@ type Server struct {
 	xfers      xfers             // files on their way between a browser and an agent
 	challenges challenges        // passkey challenges handed out
 	wsAgents   wsAgents          // agents on their WebSocket now
+	pinMisses  pinMisses         // wrong PINs per session
 	assets     map[string]string // static file -> hash of its content
 }
 
@@ -241,6 +242,9 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/panel/account/keys/finish", s.requireAdmin(s.handleKeyRegisterFinish))
 	mux.Handle("POST /api/panel/account/keys/{id}/delete", s.requireAdmin(s.handleKeyDelete))
 	mux.Handle("POST /api/panel/account/password", s.requireAdmin(s.handlePasswordToggle))
+	mux.Handle("POST /api/panel/account/pin", s.requireAdmin(s.handlePinSet))
+	mux.Handle("GET /api/panel/pin", s.requireAdmin(s.handlePinState))
+	mux.Handle("POST /api/panel/pin/check", s.requireAdmin(s.handlePinCheck))
 	mux.Handle("POST /api/panel/account/password/change", s.requireAdmin(s.handlePasswordChange))
 	mux.Handle("POST /settings/ufw/toggle", s.requireAdmin(s.handleUfwToggle))
 	mux.Handle("POST /settings/ufw/add", s.requireAdmin(s.handleUfwAdd))