perf: paginate docs list, lazy thumbnails, static cache headers

templates/base.html

@@ -50,10 +50,12 @@
           <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>
           قائمة الوثائق
         </a>
+        {% if request.state.user and request.state.user.role == 'admin' %}
         <a href="/auth/users" class="nav-link">
           <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 15c-4 0-7 2-7 4v1h14v-1c0-2-3-4-7-4z"/><circle cx="12" cy="8" r="4"/></svg>
           الإدارة
         </a>
+        {% endif %}
         <a href="/auth/logout" class="nav-link nav-link-logout">
           <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg>
           خروج

templates/users.html

@@ -15,6 +15,9 @@
     {% if backup_msg %}
     <div class="success-banner">{{ backup_msg }}</div>
     {% endif %}
+    {% if error %}
+    <div class="error-banner" style="background:#fee2e2;color:#991b1b;padding:.75rem 1rem;border-radius:8px;margin:.75rem 0">{{ error }}</div>
+    {% endif %}
 
     <div class="admin-section">
         <h3>
@@ -37,7 +40,14 @@
             </div>
             <div class="form-group">
                 <label for="password">كلمة المرور</label>
-                <input type="password" id="password" name="password" required>
+                <input type="password" id="password" name="password" required minlength="8">
+            </div>
+            <div class="form-group">
+                <label for="role">الصلاحية</label>
+                <select id="role" name="role">
+                  <option value="user">مستخدم</option>
+                  <option value="admin">مسؤول</option>
+                </select>
             </div>
             <button type="submit" class="btn btn-primary">إضافة</button>
         </form>
@@ -54,6 +64,7 @@
                     <tr>
                         <th>الرقم</th>
                         <th>اسم المستخدم</th>
+                        <th>الصلاحية</th>
                         <th>تاريخ الإنشاء</th>
                         <th></th>
                     </tr>
@@ -62,12 +73,30 @@
                     {% for user in users %}
                     <tr>
                         <td data-label="الرقم">{{ user.id }}</td>
-                        <td data-label="اسم المستخدم">{{ user.username }}</td>
+                        <td data-label="اسم المستخدم">
+                          {{ user.username }}
+                          {% if current_user and user.id == current_user.user_id %}<small style="color:#64748b">(أنت)</small>{% endif %}
+                        </td>
+                        <td data-label="الصلاحية">
+                          <form method="post" action="/auth/users/{{ user.id }}/role" class="inline-form" style="display:flex;gap:.35rem;align-items:center">
+                            <select name="role" {% if current_user and user.id == current_user.user_id %}disabled{% endif %}>
+                              <option value="user" {% if user.role == 'user' %}selected{% endif %}>مستخدم</option>
+                              <option value="admin" {% if user.role == 'admin' %}selected{% endif %}>مسؤول</option>
+                            </select>
+                            {% if not (current_user and user.id == current_user.user_id) %}
+                            <button type="submit" class="btn btn-sm btn-secondary">تغيير</button>
+                            {% endif %}
+                          </form>
+                        </td>
                         <td data-label="تاريخ الإنشاء">{{ user.created_at }}</td>
                         <td data-label="الإجراءات">
+                            {% if current_user and user.id == current_user.user_id %}
+                              <span style="color:#64748b;font-size:.85rem">—</span>
+                            {% else %}
                             <form method="post" action="/auth/users/delete/{{ user.id }}" onsubmit="return confirm('هل أنت متأكد من حذف هذا المستخدم؟');" class="inline-form">
                                 <button type="submit" class="btn btn-sm btn-danger">حذف</button>
                             </form>
+                            {% endif %}
                         </td>
                     </tr>
                     {% endfor %}