feat(updates): add Authelia-backed markdown editor

Product news is written at /admin behind Traefik forward-auth, while
the public JSON and RSS feeds stay unauthenticated.

Co-authored-by: Cursor <cursoragent@cursor.com>

services/updates-api/test/updates.test.js

@@ -52,3 +52,35 @@ test('rejects oversized request bodies', async () => {
     assert.equal(response.status, 413);
   } finally { await teardown(app); }
 });
+
+test('accepts Authelia Remote-User for admin writes and lists drafts', async () => {
+  const { app, request } = await setup();
+  try {
+    const created = await request('/v1/admin/updates', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'remote-user': 'jan' },
+      body: JSON.stringify(draft),
+    });
+    assert.equal(created.status, 201);
+    const listed = await request('/v1/admin/updates', { headers: { 'remote-user': 'jan' } });
+    assert.equal(listed.status, 200);
+    const payload = await listed.json();
+    assert.equal(payload.data.length, 1);
+    assert.equal(payload.data[0].status, 'draft');
+    assert.equal(payload.data[0].title, 'Standalone 1');
+  } finally { await teardown(app); }
+});
+
+test('serves the admin editor only to authenticated operators', async () => {
+  const { app, request } = await setup();
+  try {
+    const denied = await request('/admin');
+    assert.equal(denied.status, 401);
+    const page = await request('/admin', { headers: { 'remote-user': 'jan' } });
+    assert.equal(page.status, 200);
+    assert.match(page.headers.get('content-type'), /text\/html/);
+    const html = await page.text();
+    assert.match(html, /body_markdown/);
+    assert.match(html, /Batchmaker/);
+  } finally { await teardown(app); }
+});