rename web/ to admin/, along with the web-named build and cli identifiers

admin/src/features/settings/authority.ts

@@ -0,0 +1,25 @@
+import { useQuery } from "@tanstack/react-query";
+import { settingsQuery } from "@/lib/queries";
+import type { Authority } from "@/lib/types";
+
+/** The one-line explanation on every control file authority takes away. */
+export const READ_ONLY_HINT = "Configuration is managed by a file; edit the file and restart nxdns.";
+
+/**
+ * The running server's configuration authority, read from the settings
+ * envelope — the only route that carries it. `undefined` until that query
+ * resolves. Every page may call this: it is the shared `["settings"]` key, so
+ * the shell's own subscription serves them all from cache.
+ */
+export function useAuthority(): Authority | undefined {
+	return useQuery(settingsQuery()).data?.authority;
+}
+
+/**
+ * True only once the server has said a file owns the configuration. While the
+ * mode is unknown nothing is disabled — the 403 is the enforcement, this is
+ * the courtesy.
+ */
+export function useReadOnlyConfig(): boolean {
+	return useAuthority()?.mode === "managed_file";
+}