feat: add /admin endpoint with Basic Auth and JSON stats

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/admin_test.go

@@ -0,0 +1,64 @@
+package web
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/tolelom/catacombs/config"
+	"github.com/tolelom/catacombs/game"
+	"github.com/tolelom/catacombs/store"
+)
+
+func TestAdminEndpoint(t *testing.T) {
+	tmpDir := t.TempDir()
+	db, err := store.Open(filepath.Join(tmpDir, "test.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	defer db.Close()
+
+	cfg, _ := config.Load("")
+	cfg.Admin = config.AdminConfig{Username: "admin", Password: "secret"}
+	lobby := game.NewLobby(cfg)
+
+	handler := AdminHandler(lobby, db, time.Now())
+
+	// Test without auth → 401
+	req := httptest.NewRequest("GET", "/admin", nil)
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", w.Code)
+	}
+
+	// Test with wrong auth → 401
+	req = httptest.NewRequest("GET", "/admin", nil)
+	req.SetBasicAuth("admin", "wrong")
+	w = httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", w.Code)
+	}
+
+	// Test with correct auth → 200 + JSON
+	req = httptest.NewRequest("GET", "/admin", nil)
+	req.SetBasicAuth("admin", "secret")
+	w = httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+
+	var stats AdminStats
+	if err := json.Unmarshal(w.Body.Bytes(), &stats); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	if stats.OnlinePlayers != 0 {
+		t.Fatalf("expected 0 online, got %d", stats.OnlinePlayers)
+	}
+}