feat: add admin panel

src/beaver_gateway/frontends/base.py

@@ -15,11 +15,12 @@ from dataclasses import dataclass, field
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
-    from collections.abc import Mapping
+    from collections.abc import Mapping, Sequence
 
     from beaver_gateway.backends.base import Backend
     from beaver_gateway.core.auth import TokenStore
     from beaver_gateway.core.registry import AgentRegistry, McpRegistry
+    from beaver_gateway.storage import Database
 
 
 @dataclass(frozen=True, slots=True)
@@ -35,13 +36,32 @@ class GatewayRuntime:
     declared ``McpServer`` so ``ClaudeCodeBackendAdapter`` (Phase 2.2)
     can pass them to ``BackendOptions.mcp_servers`` without re-running
     discovery.
+
+    ``db`` (Phase 4.1) is the shared :class:`Database` handle. Phase 4.2
+    will switch ``TokenStore`` to read from it; Phase 4.3 admin/audit
+    write through it. Phase 4.1 only attaches it — existing frontends
+    ignore it.
     """
 
     agents: AgentRegistry
     mcps: McpRegistry
     backends: dict[str, Backend]
     token_store: TokenStore
+    db: Database
     mcp_internal_urls: Mapping[str, str] = field(default_factory=dict)
+    # Phase 4.3 — AdminFrontend reads creds + cookie-signing key from
+    # the runtime so the user's ``config.py`` doesn't have to know
+    # anything about env wiring. Defaulted to empty so existing tests /
+    # call sites that don't touch the admin path keep building; the
+    # admin frontend ``configure()`` itself rejects empty values.
+    admin_user: str = ""
+    admin_pass: str = ""
+    session_secret: str = ""
+    # The full sibling-frontends list, in declaration order. AdminFrontend
+    # uses it to advertise concrete bearer-endpoint URLs (host/port) on
+    # the dashboard so the operator can copy ready-to-use links / curl
+    # snippets. Other frontends ignore it.
+    frontends: Sequence[Frontend] = field(default_factory=tuple)
 
 
 class Frontend(ABC):