fix: refactor auth settings to use api.ts, fix type alignment, OIDC token exchange

- Add auth management functions to api.ts (getAuthSettings, listUsers, etc.)
- Refactor auth settings page to use centralized api.ts instead of raw fetch (FUNC-H2)
- Add loading skeleton to auth settings page (UX-M16)
- Add exchangeOidcToken() for httpOnly cookie OIDC flow (SEC-H3)
- Fix Settings TypeScript type: has_npm_password boolean (FUNC-L)
- Add last_alive_at to Instance type (FUNC-L)

web/src/lib/api.ts

@@ -331,6 +331,51 @@ export function getCurrentUser(): Promise<{ id: string; username: string; email:
 	return get<{ id: string; username: string; email: string; role: string }>('/api/auth/me');
 }
 
+// Auth settings
+export async function getAuthSettings(): Promise<any> {
+	return request<any>('/api/auth/settings');
+}
+
+export async function updateAuthSettings(settings: any): Promise<any> {
+	return request<any>('/api/auth/settings', {
+		method: 'PUT',
+		body: JSON.stringify(settings)
+	});
+}
+
+export async function listUsers(): Promise<any[]> {
+	return request<any[]>('/api/auth/users');
+}
+
+export async function createUser(data: { username: string; password: string; email?: string; role?: string }): Promise<any> {
+	return request<any>('/api/auth/users', {
+		method: 'POST',
+		body: JSON.stringify(data)
+	});
+}
+
+export async function updateUser(uid: string, data: { email?: string; role?: string }): Promise<any> {
+	return request<any>(`/api/auth/users/${uid}`, {
+		method: 'PUT',
+		body: JSON.stringify(data)
+	});
+}
+
+export async function changeUserPassword(uid: string, password: string): Promise<any> {
+	return request<any>(`/api/auth/users/${uid}/password`, {
+		method: 'PUT',
+		body: JSON.stringify({ password })
+	});
+}
+
+export async function deleteUser(uid: string): Promise<any> {
+	return request<any>(`/api/auth/users/${uid}`, { method: 'DELETE' });
+}
+
+export async function logout(): Promise<void> {
+	await request<any>('/api/auth/logout', { method: 'POST' });
+}
+
 // ── Config Export ────────────────────────────────────────────────────
 
 export function exportConfigUrl(): string {