Sign-in page redesign and Portal roles Super Admin / Admin / Viewer

Sign-in: brand panel, show / hide password, Caps Lock warning, moving
background, tab icon. Roles: Super Admin manages Admins and Viewers,
Admin manages Viewers only (and can Start / Stop, see Sign-ins), Viewer
sees claims and Runs only. create_tables.sql moves an old table.
71 test files, 1220 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/add_portal_user.py

@@ -1,9 +1,10 @@
 """
-Add a Portal User from this PC — the way the first Admin is made, when
-nobody can sign in to the Portal yet (spec 2026-10-22 Stage 2, EEWA-32).
+Add a Portal User from this PC — the way the first Super Admin is made,
+when nobody can sign in to the Portal yet, and the only way to make any
+Super Admin (spec 2026-10-22 Stage 2, EEWA-32; roles 2026-10-27).
 
     python tools\\add_portal_user.py                 (asks for everything)
-    python tools\\add_portal_user.py asha Admin "Asha R"
+    python tools\\add_portal_user.py asha "Super Admin" "Asha R"
 
 The password is typed hidden and twice; it is never shown, logged or
 passed on the command line. Needs `tools\\sql\\create_tables.sql` run once
@@ -31,7 +32,8 @@ from web.users import Accounts, ROLES, SqlUserStore, UserError
 def main(argv) -> int:
     username = argv[0] if argv else input("Username: ").strip()
     role = argv[1] if len(argv) > 1 else (
-        input(f"Role ({' / '.join(ROLES)}) [Admin]: ").strip() or "Admin")
+        input(f"Role ({' / '.join(ROLES)}) [Super Admin]: ").strip()
+        or "Super Admin")
     name = argv[2] if len(argv) > 2 else input("Name shown on the Portal: ")
     password = getpass.getpass("Password (10+ characters, hidden): ")
     if getpass.getpass("Password again: ") != password:

tools/sql/create_tables.sql

@@ -60,7 +60,7 @@ BEGIN
     CREATE TABLE dbo.CV_PortalUser (
         username       NVARCHAR(50)   NOT NULL PRIMARY KEY,  -- lower case
         display_name   NVARCHAR(100)  NOT NULL,
-        role           NVARCHAR(20)   NOT NULL,  -- Admin / Operator / Viewer
+        role           NVARCHAR(20)   NOT NULL,  -- Super Admin / Admin / Viewer
         pw_hash        CHAR(64)       NOT NULL,  -- hex
         pw_salt        CHAR(32)       NOT NULL,  -- hex
         pw_iterations  INT            NOT NULL,
@@ -72,10 +72,24 @@ BEGIN
         created_by     NVARCHAR(50)   NOT NULL,
         changed_at     DATETIME2      NOT NULL,
         CONSTRAINT CK_CV_PortalUser_role
-            CHECK (role IN ('Admin', 'Operator', 'Viewer'))
+            CHECK (role IN ('Super Admin', 'Admin', 'Viewer'))
     );
 END
 GO
+-- Roles from 2026-10-27: Super Admin / Admin / Viewer, no Operator. A table
+-- made before then: its Admins become Super Admins and its Operators
+-- Admins, in that order. Runs until there is a Super Admin; safe to run
+-- again. (Not read from sys.check_constraints: the bot's login may not see
+-- a constraint's definition.)
+IF NOT EXISTS (SELECT 1 FROM dbo.CV_PortalUser WHERE role = 'Super Admin')
+BEGIN
+    ALTER TABLE dbo.CV_PortalUser DROP CONSTRAINT CK_CV_PortalUser_role;
+    UPDATE dbo.CV_PortalUser SET role = 'Super Admin' WHERE role = 'Admin';
+    UPDATE dbo.CV_PortalUser SET role = 'Admin' WHERE role = 'Operator';
+    ALTER TABLE dbo.CV_PortalUser ADD CONSTRAINT CK_CV_PortalUser_role
+        CHECK (role IN ('Super Admin', 'Admin', 'Viewer'));
+END
+GO
 IF OBJECT_ID('dbo.CV_PortalSignIn', 'U') IS NULL
 BEGIN
     CREATE TABLE dbo.CV_PortalSignIn (
@@ -84,7 +98,7 @@ BEGIN
         username  NVARCHAR(50)  NOT NULL,  -- as typed, for a wrong one
         event     NVARCHAR(30)  NOT NULL,  -- sign_in, sign_out, wrong_password,
                                            -- locked, timeout, user_created, ...
-        by_user   NVARCHAR(50)  NULL       -- the Admin, for an Admin change
+        by_user   NVARCHAR(50)  NULL       -- the Super Admin / Admin who changed it
     );
     CREATE INDEX IX_CV_PortalSignIn_at ON dbo.CV_PortalSignIn (at);
 END