Per-host HTTP basic auth (#57)

Adds opt-in basic auth per Host, following the existing per-host controls
pattern:
- Host fields basicauth_enabled / basicauth_realm / basicauth_users
  ({user: base64(sha1(pw))}). Credentials are parsed to plaintext by the pure
  host_features normalizer and hashed at the route layer (utils/basicauth.js),
  so plaintext never reaches Redis.
- ops/nginx_conf/hostfeatures.lua enforces it in access phase: verifies the
  Authorization header against base64(sha1(password)), fails closed with a 401
  WWW-Authenticate challenge.
- hosts.ejs gains an enable toggle, realm, and a username:password textarea
  (passwords never echoed back; blank keeps the current set).

Unit tests cover hashing (matches the htpasswd {SHA} vector), credential
parsing, and normalization. Note: the Lua path needs verification on a live
OpenResty box.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/host.js

@@ -5,6 +5,7 @@ const {Host, Domain} = require('../models').models;
 const authz = require('../middleware/authz');
 const {normalizeHostFeatures} = require('../utils/host_features');
 const {collectHostFieldErrors} = require('../utils/hostname_validate');
+const {hashBasicAuthUsers} = require('../utils/basicauth');
 
 const Model = Host;
 
@@ -15,6 +16,15 @@ function validateHostFields(body){
 	if(errors.length) throw Model.errors.ObjectValidateError(errors);
 }
 
+// After normalizeHostFeatures has parsed basic-auth creds to {user: plaintext},
+// hash them so plaintext never reaches Redis. Runs at the route layer only, so
+// internally-copied records (cache/wildcard children) keep their existing hashes.
+function hashHostSecrets(body){
+	if(body.basicauth_users && typeof body.basicauth_users === 'object'){
+		body.basicauth_users = hashBasicAuthUsers(body.basicauth_users);
+	}
+}
+
 router.get('/', async function(req, res, next){
 	try{
 		let results = await Model[req.query.detail ? "listDetail" : "list"]();
@@ -35,6 +45,7 @@ router.post('/', authz.requireDomainRole('manager', authz.resolve.hostBody), asy
 		req.body.created_by = authz.reqUsername(req);
 		validateHostFields(req.body);
 		normalizeHostFeatures(req.body);
+		hashHostSecrets(req.body);
 		let item = await Model.create(req.body);
 
 		return res.json({
@@ -100,6 +111,7 @@ router.put('/:item', authz.requireDomainRole('manager', authz.resolve.hostParam)
 		req.body.updated_by = authz.reqUsername(req);
 		validateHostFields(req.body);
 		normalizeHostFeatures(req.body);
+		hashHostSecrets(req.body);
 		let item = await Model.get(req.params.item);
 		item = await item.update(req.body);