fix(observability): router conflict, logout button, missing i18n

- Fix chi duplicate Route() panic by consolidating read/write routes
  into single Route blocks with nested admin Group
- Add logout button to sidebar with token cleanup
- Add missing settingsAuth.password i18n key

internal/api/router.go

@@ -138,55 +138,10 @@ func (s *Server) Router() chi.Router {
 				r.Get("/stages/{stage}/instances", s.listInstances)
 				r.Get("/stages/{stage}/instances/{iid}/stats", s.getInstanceStats)
 				r.Get("/volumes", s.listVolumes)
-			})
-			r.Get("/deploys", s.listDeploys)
-			r.Get("/deploys/{id}/logs", s.streamDeployLogs)
-			r.Get("/events", s.streamEvents)
-			r.Get("/events/log", s.listEventLog)
-			r.Get("/events/log/stats", s.getEventLogStats)
-			r.Get("/registries", s.listRegistries)
-			r.Route("/registries/{id}", func(r chi.Router) {
-				r.Get("/tags/*", s.listRegistryTags)
-				r.Get("/images", s.listRegistryImages)
-			})
-			r.Get("/settings", s.getSettings)
-			r.Get("/settings/npm-certificates", s.listNpmCertificates)
 
-			// Stale container endpoints.
-			r.Get("/containers/stale", s.listStaleContainers)
-
-			// Proxy endpoints (read-only for any authenticated user).
-			r.Get("/proxies", s.listProxies)
-			r.Get("/proxies/all", s.listAllProxies)
-			r.Route("/proxies/{id}", func(r chi.Router) {
-				r.Get("/", s.getProxy)
-			})
-
-			// Admin-only routes: require admin role.
-			r.Group(func(r chi.Router) {
-				r.Use(auth.AdminOnly)
-
-				// Proxy mutation endpoints.
-				r.Post("/proxies/validate", s.validateProxy)
-				r.Post("/proxies", s.createProxy)
-				r.Route("/proxies/{id}", func(r chi.Router) {
-					r.Put("/", s.updateProxy)
-					r.Delete("/", s.deleteProxy)
-				})
-
-				// Config export (reveals project/infra details).
-				r.Get("/config/export", s.exportConfig)
-
-				// Auth management.
-				r.Get("/auth/settings", s.getAuthSettings)
-				r.Put("/auth/settings", s.updateAuthSettings)
-				r.Get("/auth/users", s.listUsers)
-				r.Post("/auth/users", s.createUser)
-				r.Delete("/auth/users/{uid}", s.deleteUser)
-
-				// Project mutation endpoints.
-				r.Post("/projects", s.createProject)
-				r.Route("/projects/{id}", func(r chi.Router) {
+				// Admin-only project mutations.
+				r.Group(func(r chi.Router) {
+					r.Use(auth.AdminOnly)
 					r.Put("/", s.updateProject)
 					r.Delete("/", s.deleteProject)
 
@@ -214,20 +169,73 @@ func (s *Server) Router() chi.Router {
 					r.Put("/volumes/{volId}", s.updateVolume)
 					r.Delete("/volumes/{volId}", s.deleteVolume)
 				})
+			})
+			r.Get("/deploys", s.listDeploys)
+			r.Get("/deploys/{id}/logs", s.streamDeployLogs)
+			r.Get("/events", s.streamEvents)
+			r.Get("/events/log", s.listEventLog)
+			r.Get("/events/log/stats", s.getEventLogStats)
+			r.Get("/registries", s.listRegistries)
+			r.Route("/registries/{id}", func(r chi.Router) {
+				r.Get("/tags/*", s.listRegistryTags)
+				r.Get("/images", s.listRegistryImages)
+
+				// Admin-only registry mutations.
+				r.Group(func(r chi.Router) {
+					r.Use(auth.AdminOnly)
+					r.Put("/", s.updateRegistry)
+					r.Delete("/", s.deleteRegistry)
+					r.Post("/test", s.testRegistry)
+				})
+			})
+			r.Get("/settings", s.getSettings)
+			r.Get("/settings/npm-certificates", s.listNpmCertificates)
+
+			// Stale container endpoints (read).
+			r.Get("/containers/stale", s.listStaleContainers)
+
+			// Proxy endpoints (read-only for any authenticated user).
+			r.Get("/proxies", s.listProxies)
+			r.Get("/proxies/all", s.listAllProxies)
+			r.Route("/proxies/{id}", func(r chi.Router) {
+				r.Get("/", s.getProxy)
+				// Admin-only proxy mutations.
+				r.Group(func(r chi.Router) {
+					r.Use(auth.AdminOnly)
+					r.Put("/", s.updateProxy)
+					r.Delete("/", s.deleteProxy)
+				})
+			})
+
+			// Admin-only routes: require admin role.
+			r.Group(func(r chi.Router) {
+				r.Use(auth.AdminOnly)
+
+				// Config export (reveals project/infra details).
+				r.Get("/config/export", s.exportConfig)
+
+				// Auth management.
+				r.Get("/auth/settings", s.getAuthSettings)
+				r.Put("/auth/settings", s.updateAuthSettings)
+				r.Get("/auth/users", s.listUsers)
+				r.Post("/auth/users", s.createUser)
+				r.Delete("/auth/users/{uid}", s.deleteUser)
+
+				// Project creation.
+				r.Post("/projects", s.createProject)
 
 				// Quick deploy endpoints.
 				r.Post("/deploy/inspect", s.inspectImage)
 				r.Post("/deploy/quick", s.quickDeploy)
 
-				// Registry mutation endpoints.
+				// Registry creation.
 				r.Post("/registries", s.createRegistry)
-				r.Route("/registries/{id}", func(r chi.Router) {
-					r.Put("/", s.updateRegistry)
-					r.Delete("/", s.deleteRegistry)
-					r.Post("/test", s.testRegistry)
-				})
 
-				// Stale container cleanup endpoints (admin-only).
+				// Proxy mutation endpoints.
+				r.Post("/proxies/validate", s.validateProxy)
+				r.Post("/proxies", s.createProxy)
+
+				// Stale container cleanup endpoints.
 				// Bulk route must be registered before parameterized route.
 				r.Post("/containers/stale/cleanup", s.bulkCleanupStaleContainers)
 				r.Post("/containers/stale/{id}/cleanup", s.cleanupStaleContainer)