add a few CLI commands

CLI.md

@@ -0,0 +1,85 @@
+# Admin CLI
+
+Operator tools for accounts on the shared `recflare` D1 database, exposed as an
+`admin` command group on the repo's `runx` CLI. Each command shells out to
+`wrangler d1 execute recflare` — no running worker or auth token needed.
+
+Run from anywhere in the repo:
+
+```sh
+bun runx admin <command> [options]
+```
+
+## Commands
+
+### `set-password` — set (or replace) an account's login password
+
+```sh
+bun runx admin set-password --account 1
+bun runx admin set-password --username alice --remote
+```
+
+The new password is taken from `--password <pw>`, else from piped stdin, else
+prompted interactively (hidden input, entered twice and compared):
+
+```sh
+# interactive (prompts, hidden)
+bun runx admin set-password --account 1
+
+# non-interactive / scripted
+echo "s3cret-pw" | bun runx admin set-password --account 1
+bun runx admin set-password --account 1 --password "s3cret-pw"
+```
+
+### `clear-password` — remove an account's password
+
+Leaves the account with no login credential (it can't be logged into until a
+password is set again).
+
+```sh
+bun runx admin clear-password --username alice
+```
+
+### `grant-developer` — grant or revoke the developer role
+
+Backs `GET /role/developer/:id`. Off by default; only this command grants it.
+
+```sh
+bun runx admin grant-developer --account 1
+bun runx admin grant-developer --account 1 --revoke
+```
+
+### `lookup` — print an account
+
+```sh
+bun runx admin lookup --account 1
+bun runx admin lookup --username alice
+```
+
+Prints id, username, platform, platform id, created/last-login times, and whether
+the account has a password and the developer role.
+
+## Options
+
+### Selecting an account
+
+Every command targets exactly one account, by **either**:
+
+- `--account <id>` — numeric account id
+- `--username <name>` — username (case-insensitive)
+
+### Choosing the database
+
+- `--local` — the local dev database (**the default**)
+- `--remote` — the deployed (production) database
+
+Passing both is an error. `--remote` requires `RECFLARE_D1` in the gitignored root
+`.env` (see `.env.example`) and a wrangler login with access to the account.
+
+## Notes
+
+- Password hashing matches the auth worker exactly (PBKDF2-SHA256), so a password
+  set here verifies at login.
+- A command that matches no account exits non-zero with `no account found for …`.
+- Local writes target `apps/auth`'s dev D1 state; run `bun turbo -F auth migrate -- --local`
+  first if the local database hasn't been migrated yet.