Admin: the owner is the app's admin, can name moderators, and every setting lives on one admin page #12

Goal (owner, 2026-10-20): complete, secure, public control of the real arm from the public forge URL, with a moderated community. Simple and amazing to use; every knob the owner might want is an admin setting.

Milestone 2 (community). Roles from the forge's signed x-forge-identity (verify the signature): the repo owner is admin; admin can add/remove moderators by username. An /admin page (admin + moderators; settings editable by admin only) with a settings store persisted on disk (survives restarts) and a change log (who changed what, when). Settings land here as later issues add them. Non-admins get 404 on /admin. Tests: owner sees /admin; anonymous and plain users get 404; moderator sees but cannot edit settings; changes persist across restart.

Ready again: pull #22 was closed because main moved under it and it could not be brought up to date. Conflicting files: Software/so101/src/relay.ts.

Already done on main in 5d4fef3 (pull #45): the owner is admin from the signed forge identity, moderators are named and removed on /admin, settings persist on disk with a change log, and src/admin-relay.test.ts covers owner / moderator / persistence. Closing as done; #13 can start.

Split into #136 and #137. A builder left this without a pull because most of it is already on main (5d4fef3, pull #45), and a close as done is beyond my scope. The fresh issues cover only what main still lacks against the spec. #136 is a test that settings and moderators survive a relay restart. #137 makes non-admins get 404 on /admin (main answers 401/403); it waits on the /admin move, #121 and #122. #13 now waits on #136.