feat: RBAC, atomic deployments, and fleet-wide backups (Pro) (#181)

* feat: add RBAC viewer accounts, atomic deployments, and fleet-wide backups (Pro)

Introduces three Pro-tier features:

- RBAC: Multi-user system with admin/viewer roles, user management UI,
  automatic migration from single-admin credentials, viewer restrictions
  across the entire UI (read-only editor, hidden action buttons)

- Atomic Deployments: Pre-deploy file backup to .sencho-backup/, automatic
  rollback on health probe failure, manual rollback button, health probes
  added to stack updates, webhook-triggered deploys use atomic rollback

- Fleet-Wide Backups: Point-in-time snapshots of compose files across all
  nodes (local + remote), stored centrally in SQLite, per-stack restore
  with optional redeploy, graceful handling of offline nodes

* fix(settings): use correct ProGate prop name in UsersSection

* fix(settings): remove unused isPro prop from UsersSection

* fix(auth): fetch user info after login and setup so isAdmin is set correctly

frontend/src/context/AuthContext.tsx

@@ -2,10 +2,17 @@ import { createContext, useContext, useState, useEffect, type ReactNode } from '
 
 type AppStatus = 'loading' | 'needsSetup' | 'notAuthenticated' | 'authenticated';
 
+interface UserInfo {
+  username: string;
+  role: 'admin' | 'viewer';
+}
+
 interface AuthContextType {
   appStatus: AppStatus;
   isAuthenticated: boolean;
   needsSetup: boolean;
+  user: UserInfo | null;
+  isAdmin: boolean;
   login: (username: string, password: string) => Promise<{ success: boolean; error?: string }>;
   logout: () => Promise<void>;
   completeSetup: () => void;
@@ -16,6 +23,7 @@ const AuthContext = createContext<AuthContextType | undefined>(undefined);
 
 export function AuthProvider({ children }: { children: ReactNode }) {
   const [appStatus, setAppStatus] = useState<AppStatus>('loading');
+  const [user, setUser] = useState<UserInfo | null>(null);
 
   const checkAuth = async () => {
     try {
@@ -24,9 +32,10 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         credentials: 'include',
       });
       const statusData = await statusResponse.json();
-      
+
       if (statusData.needsSetup) {
         setAppStatus('needsSetup');
+        setUser(null);
         return;
       }
 
@@ -34,13 +43,17 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       const authResponse = await fetch('/api/auth/check', {
         credentials: 'include',
       });
-      
+
       if (authResponse.ok) {
+        const data = await authResponse.json();
+        setUser(data.user ?? null);
         setAppStatus('authenticated');
       } else {
+        setUser(null);
         setAppStatus('notAuthenticated');
       }
     } catch {
+      setUser(null);
       setAppStatus('notAuthenticated');
     }
   };
@@ -67,6 +80,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 
       if (response.ok && data.success) {
         setAppStatus('authenticated');
+        // Fetch user info (role, username) so isAdmin is correct immediately
+        await checkAuth();
         return { success: true };
       } else {
         return { success: false, error: data.error || 'Login failed' };
@@ -85,23 +100,27 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     } catch (error) {
       console.error('Logout error:', error);
     } finally {
+      setUser(null);
       setAppStatus('notAuthenticated');
     }
   };
 
   const completeSetup = () => {
-    setAppStatus('authenticated');
+    // Fetch user info so isAdmin is correct after setup
+    checkAuth();
   };
 
   return (
-    <AuthContext.Provider value={{ 
-      appStatus, 
-      isAuthenticated: appStatus === 'authenticated', 
+    <AuthContext.Provider value={{
+      appStatus,
+      isAuthenticated: appStatus === 'authenticated',
       needsSetup: appStatus === 'needsSetup',
-      login, 
-      logout, 
+      user,
+      isAdmin: user?.role === 'admin',
+      login,
+      logout,
       completeSetup,
-      checkAuth 
+      checkAuth
     }}>
       {children}
     </AuthContext.Provider>