Initial commit: UOMysticmoon backend (Express + MariaDB + JWT)

- Layered API (router -> controller -> model -> db), serverlinkr pattern
- Public / auth / admin route groups; posts, wiki, settings, users, activity models
- JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS)
- Site LIVE/MAINTENANCE mode with admin preview bypass
- Dual file+console logging (info/warn/error/debug) + HTTP access logs
- Docker Compose (app + MariaDB), schema.sql + seed, .env.example
- Verified end-to-end against MariaDB (27/27 smoke checks)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/model/users/users.db.js

@@ -0,0 +1,67 @@
+const { query } = require('../../utils/db')
+
+const PUBLIC_COLS = 'id, username, role, created_at, last_login_at'
+
+async function insertUser({ username, passwordHash, role = 'admin' }) {
+  const res = await query(
+    'INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)',
+    [username, passwordHash, role],
+  )
+  return res.insertId
+}
+
+async function findByUsername(username) {
+  const rows = await query('SELECT * FROM users WHERE username = ? LIMIT 1', [username])
+  return rows[0] || null
+}
+
+async function findById(id) {
+  const rows = await query('SELECT * FROM users WHERE id = ? LIMIT 1', [id])
+  return rows[0] || null
+}
+
+async function listUsers() {
+  return query(`SELECT ${PUBLIC_COLS} FROM users ORDER BY id ASC`)
+}
+
+async function updateUser(id, fields) {
+  const cols = []
+  const params = []
+  for (const [key, val] of Object.entries(fields)) {
+    cols.push(`${key} = ?`)
+    params.push(val)
+  }
+  if (cols.length === 0) return
+  params.push(id)
+  await query(`UPDATE users SET ${cols.join(', ')} WHERE id = ?`, params)
+}
+
+async function deleteUser(id) {
+  return query('DELETE FROM users WHERE id = ?', [id])
+}
+
+async function countUsers() {
+  const rows = await query('SELECT COUNT(*) AS c FROM users')
+  return Number(rows[0].c)
+}
+
+async function countAdmins() {
+  const rows = await query("SELECT COUNT(*) AS c FROM users WHERE role = 'admin'")
+  return Number(rows[0].c)
+}
+
+async function touchLastLogin(id) {
+  return query('UPDATE users SET last_login_at = NOW() WHERE id = ?', [id])
+}
+
+module.exports = {
+  insertUser,
+  findByUsername,
+  findById,
+  listUsers,
+  updateUser,
+  deleteUser,
+  countUsers,
+  countAdmins,
+  touchLastLogin,
+}