v0.1.1: admin gate in the template

Security fix for apps scaffolded from template/.

Version 0.1.0 shipped a web UI with no admin authentication. Anyone who could reach a deployed copy could read stored results and start paid looot runs on the operator's token, and the caller of /api/run chose the spend cap. If you built an app from 0.1.0 and run it on a reachable host, upgrade it now: copy src/proxy.ts, src/lib/auth/, src/app/login/, src/app/api/auth/ and the changed src/app/api/run/route.ts from this release, set APP_ADMIN_PASSWORD (12 characters or more), and redeploy.

What changed

• The template ships the admin gate from looot-reveal v0.2.1: signed session cookie, password check, lockout, CSRF token plus same-origin check, middleware plus a per-route server check.
• Tests are generated from src/app, so a new route with no gate fails.
• The web UI spend cap comes from APP_SPEND_CAP_USD on the server. /api/run ignores a cap in the request, always quotes first and allows 10 paid runs a minute per session. The rate limit counts per server instance.
• Demo mode stays open with a Demo, no sign-in badge and refuses to start next to a real LOOOT_TOKEN.
• rebuild-on-looot now requires the gate in every scaffolded app, with a checklist, passing gate tests and a Securing a deployment README section.
• npm run check fails if the template loses the gate files.