Add web admin panel for accounts/characters (login, GM rights, live stats)

New "webadmin" service (Flask + PyMySQL, port 8081) backing a small
server-rendered admin UI:
- Login gated on an existing game account: only accounts with
  accesslevel >= ADMIN_MIN_ACCESSLEVEL (default 900) get in. Password
  is MD5-hashed before comparison since the game client hashes it
  client-side before it ever hits the wire -- accounts.password is
  always an MD5 hex digest, confirmed against existing DB rows.
- Accounts: list/search, create, edit accesslevel/active/password.
- Characters: list/search, create (mirrors the real char-creation
  INSERT in Src/Char Server/charpackets.cpp -- only account_name,
  char_name, face, hairStyle, sex are set, everything else relies on
  the table's own defaults), edit core stats (level, zuly, attributes,
  hp/mp, stat/skill points) and isgm/isdev flags directly.

All queries are parameterized (no string-formatted SQL). No CSRF
protection or rate limiting yet -- acceptable for a small
already-behind-a-high-accesslevel-gate private server, worth
revisiting before ever exposing this port publicly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webadmin/templates/base.html

@@ -0,0 +1,96 @@
+<!doctype html>
+<html lang="de">
+<head>
+<meta charset="utf-8">
+<title>{% block title %}ROSS Admin{% endblock %}</title>
+<style>
+  :root {
+    color-scheme: dark;
+    --bg: #14161c;
+    --panel: #1d2029;
+    --border: #2c3040;
+    --text: #e4e6ec;
+    --muted: #9098ab;
+    --accent: #5b8cff;
+    --danger: #e0556f;
+    --ok: #4fbf7a;
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    font-family: -apple-system, Segoe UI, Roboto, sans-serif;
+    background: var(--bg);
+    color: var(--text);
+  }
+  header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 14px 24px;
+    background: var(--panel);
+    border-bottom: 1px solid var(--border);
+  }
+  header a { color: var(--text); text-decoration: none; font-weight: 600; }
+  nav a { color: var(--muted); text-decoration: none; margin-right: 18px; font-size: 14px; }
+  nav a:hover { color: var(--text); }
+  main { max-width: 960px; margin: 0 auto; padding: 24px; }
+  table { width: 100%; border-collapse: collapse; margin-top: 12px; }
+  th, td { text-align: left; padding: 8px 10px; border-bottom: 1px solid var(--border); font-size: 14px; }
+  th { color: var(--muted); font-weight: 600; font-size: 12px; text-transform: uppercase; }
+  tr:hover td { background: #ffffff08; }
+  a.btn, button {
+    display: inline-block;
+    background: var(--accent);
+    color: white;
+    border: none;
+    padding: 8px 14px;
+    border-radius: 6px;
+    font-size: 14px;
+    cursor: pointer;
+    text-decoration: none;
+  }
+  a.btn.secondary, button.secondary { background: #33384a; }
+  a.btn.small { padding: 4px 10px; font-size: 12px; }
+  input, select {
+    background: #10121a;
+    border: 1px solid var(--border);
+    color: var(--text);
+    padding: 8px 10px;
+    border-radius: 6px;
+    font-size: 14px;
+    width: 100%;
+  }
+  label { display: block; font-size: 12px; color: var(--muted); margin: 12px 0 4px; }
+  form.inline { display: inline; }
+  .flash { background: #3a2f1a; border: 1px solid #6b4f1f; color: #ffd889; padding: 10px 14px; border-radius: 6px; margin-bottom: 16px; }
+  .card { background: var(--panel); border: 1px solid var(--border); border-radius: 10px; padding: 20px; margin-bottom: 20px; }
+  .grid { display: grid; grid-template-columns: 1fr 1fr; gap: 0 20px; }
+  .searchbar { display: flex; gap: 10px; margin-bottom: 10px; }
+  .searchbar input { flex: 1; }
+  .badge { display: inline-block; padding: 2px 8px; border-radius: 999px; font-size: 11px; font-weight: 600; }
+  .badge.ok { background: #163a26; color: var(--ok); }
+  .badge.off { background: #3a1620; color: var(--danger); }
+  .row-actions a { margin-right: 8px; }
+</style>
+</head>
+<body>
+<header>
+  <a href="{{ url_for('dashboard') }}">ROSS Admin</a>
+  {% if session.get('username') %}
+  <nav>
+    <a href="{{ url_for('accounts') }}">Accounts</a>
+    <a href="{{ url_for('characters') }}">Charaktere</a>
+    <a href="{{ url_for('logout') }}">Logout ({{ session['username'] }})</a>
+  </nav>
+  {% endif %}
+</header>
+<main>
+  {% with messages = get_flashed_messages() %}
+    {% if messages %}
+      {% for m in messages %}<div class="flash">{{ m }}</div>{% endfor %}
+    {% endif %}
+  {% endwith %}
+  {% block content %}{% endblock %}
+</main>
+</body>
+</html>