Add editable display title (was hardcoded to VITE_HOTEL_NAME)

New `config` table + routes/config.js: GET /api/public/config (no auth,
Display.tsx needs it with no session) and PUT /api/admin/config (authed +
'settings' cap). A blank title clears the override and falls back to the
build-time VITE_HOTEL_NAME, so an unconfigured install still shows
something sensible. Admin.tsx gets a "Display title" field above the
existing status card.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/db.js

@@ -48,8 +48,18 @@ export async function initDb() {
       sunset     TIMESTAMPTZ,
       fetched_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
     );
-  `)
 
+    -- User-editable display settings (currently just display_title). Separate from
+    -- the status table (fetch bookkeeping, not user-facing) -- same KV shape as
+    -- tasks' config table. A missing/null display_title falls back to
+    -- VITE_HOTEL_NAME at the frontend (see routes/config.js), so an unconfigured
+    -- app still shows something sensible without requiring a rebuild.
+    CREATE TABLE IF NOT EXISTS config (
+      key        TEXT PRIMARY KEY,
+      value      JSONB NOT NULL,
+      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    );
+  `)
 }
 
 export async function getStatus() {
@@ -64,3 +74,16 @@ export async function setStatus(key, value) {
     [key, JSON.stringify(value)]
   )
 }
+
+export async function getConfig() {
+  const { rows } = await pool.query('SELECT key, value FROM config')
+  return Object.fromEntries(rows.map(r => [r.key, r.value]))
+}
+
+export async function setConfigValue(key, value) {
+  await pool.query(
+    `INSERT INTO config (key, value, updated_at) VALUES ($1, $2, NOW())
+     ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()`,
+    [key, JSON.stringify(value)]
+  )
+}

backend/src/index.js

@@ -4,6 +4,7 @@ import cors from '@fastify/cors'
 import { initDb } from './db.js'
 import { startScheduler } from './lib/scheduler.js'
 import { publicForecastRoutes, internalForecastRoutes, adminForecastRoutes } from './routes/forecast.js'
+import { publicConfigRoutes, adminConfigRoutes } from './routes/config.js'
 
 const app = Fastify({ logger: true, trustProxy: true })
 const startedAt = Date.now()
@@ -19,6 +20,8 @@ app.get('/health', async () => ({ status: 'healthy', version: process.env.BUILD_
 await app.register(publicForecastRoutes)
 await app.register(internalForecastRoutes)
 await app.register(adminForecastRoutes)
+await app.register(publicConfigRoutes)
+await app.register(adminConfigRoutes)
 
 try {
   await initDb()

backend/src/routes/config.js

@@ -0,0 +1,32 @@
+import { getConfig, setConfigValue } from '../db.js'
+import { requireAuth, requireCap } from '../auth.js'
+
+// Only these keys are writable through the API.
+const ALLOWED_KEYS = new Set(['display_title'])
+
+// GET is public (not under requireAuth) — Display.tsx needs the title with no
+// session at all, same reasoning as routes/forecast.js's publicForecastRoutes.
+// Nothing sensitive lives in `config`, just display copy, so that's fine.
+export async function publicConfigRoutes(app) {
+  app.get('/api/public/config', async () => {
+    const config = await getConfig()
+    return { display_title: config.display_title ?? null }
+  })
+}
+
+// Write is authed + 'settings' cap, same as the forecast admin routes.
+export async function adminConfigRoutes(app) {
+  app.put('/api/admin/config', { preHandler: [requireAuth, requireCap('settings')] }, async (req, reply) => {
+    const body = req.body || {}
+    for (const key of Object.keys(body)) {
+      if (!ALLOWED_KEYS.has(key)) return reply.status(400).send({ error: `Unknown setting: ${key}` })
+    }
+    if ('display_title' in body) {
+      const title = typeof body.display_title === 'string' ? body.display_title.trim() : ''
+      // Empty string clears the override, reverting the display to VITE_HOTEL_NAME.
+      await setConfigValue('display_title', title || null)
+    }
+    const config = await getConfig()
+    return { display_title: config.display_title ?? null }
+  })
+}