Add password confirmation and an admin users/privkey panel

Registration now requires the password twice, rejected client-side on
mismatch before hitting the API. The admin page gets a Utenti card:
loads the user list (id, username, address, balance in PLM) and a
per-row "Mostra" button that reveals the private key after an explicit
confirm() — click again to hide it. A persistent warning banner notes
that every reveal is audit-logged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/static/admin.html

@@ -84,6 +84,26 @@
 
   .hidden { display: none !important; }
 
+  table { width: 100%; border-collapse: collapse; font-size: 0.85rem; }
+  th, td { text-align: left; padding: 8px 6px; border-bottom: 1px solid var(--color-border); vertical-align: top; }
+  th { color: var(--color-muted-foreground); font-weight: 500; }
+  td.addr { font-family: 'Fira Code', monospace; word-break: break-all; max-width: 160px; }
+
+  button.reveal {
+    width: auto; margin-top: 0; padding: 4px 10px; min-height: 30px; font-size: 0.78rem;
+    background: var(--color-destructive-bg); color: var(--color-destructive); border: 1px solid var(--color-destructive);
+  }
+
+  .privkey-box {
+    margin-top: 6px; padding: 8px; border-radius: 6px; font-size: 0.78rem;
+    background: var(--color-destructive-bg); border: 1px solid var(--color-destructive);
+    word-break: break-all; font-family: 'Fira Code', monospace; color: var(--color-foreground);
+  }
+  .warning-banner {
+    background: var(--color-destructive-bg); border: 1px solid var(--color-destructive); color: var(--color-destructive);
+    border-radius: 8px; padding: 10px 12px; font-size: 0.8rem; margin-bottom: 14px; font-weight: 500;
+  }
+
   #toast-container {
     position: fixed; bottom: 20px; left: 50%; transform: translateX(-50%);
     display: flex; flex-direction: column; gap: 8px; z-index: 100; width: calc(100% - 40px); max-width: 440px;
@@ -129,6 +149,26 @@
   </div>
 </div>
 
+<div class="card">
+  <h2 style="font-size:1rem;font-weight:600;margin:0 0 4px">Utenti</h2>
+  <p class="hint">Elenco utenti registrati, con saldo interno e accesso alla chiave privata per interventi manuali (es. restituire fondi bloccati).</p>
+
+  <div class="warning-banner">
+    ⚠ La chiave privata dà accesso completo ai fondi dell'utente. Ogni volta che la visualizzi viene registrata nell'audit log del server. Non condividerla, non salvarla altrove.
+  </div>
+
+  <button class="secondary" onclick="loadUsers()" id="users-load-btn">Carica utenti</button>
+
+  <div id="users-table-wrap" class="hidden" style="overflow-x:auto;margin-top:14px">
+    <table>
+      <thead>
+        <tr><th>ID</th><th>Username</th><th>Indirizzo</th><th>Saldo (PLM)</th><th>Chiave</th></tr>
+      </thead>
+      <tbody id="users-tbody"></tbody>
+    </table>
+  </div>
+</div>
+
 <div id="toast-container" aria-live="polite"></div>
 
 <script>
@@ -193,6 +233,59 @@ async function adminSave() {
     }
   });
 }
+
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+
+async function loadUsers() {
+  const btn = document.getElementById('users-load-btn');
+  await withLoading(btn, 'Caricamento…', async () => {
+    try {
+      const users = await callAdmin('GET', '/admin/users');
+      const tbody = document.getElementById('users-tbody');
+      tbody.innerHTML = users.map((u) => `
+        <tr>
+          <td>${u.id}</td>
+          <td>${escapeHtml(u.username)}</td>
+          <td class="addr">${escapeHtml(u.address)}</td>
+          <td>${u.balance_sats / SATS_PER_PLM}</td>
+          <td>
+            <button class="reveal" onclick="revealPrivkey(${u.id}, this)">Mostra</button>
+            <div class="privkey-box hidden" id="privkey-${u.id}"></div>
+          </td>
+        </tr>
+      `).join('');
+      document.getElementById('users-table-wrap').classList.remove('hidden');
+      toast('Utenti caricati (' + users.length + ').', 'success');
+    } catch (e) {
+      toast('Errore: ' + e.message, 'error');
+    }
+  });
+}
+
+async function revealPrivkey(userId, button) {
+  const box = document.getElementById('privkey-' + userId);
+  if (!box.classList.contains('hidden')) {
+    box.classList.add('hidden');
+    box.textContent = '';
+    button.textContent = 'Mostra';
+    return;
+  }
+  if (!window.confirm('Stai per visualizzare la chiave privata di questo utente. L\'accesso verrà registrato nell\'audit log. Continuare?')) {
+    return;
+  }
+  await withLoading(button, '…', async () => {
+    try {
+      const data = await callAdmin('GET', '/admin/users/' + userId + '/privkey');
+      box.textContent = data.wif;
+      box.classList.remove('hidden');
+      button.textContent = 'Nascondi';
+    } catch (e) {
+      toast('Errore: ' + e.message, 'error');
+    }
+  });
+}
 </script>
 
 </body>