rename web/ to admin/, along with the web-named build and cli identifiers

docs/how-to/install-with-docker.md

@@ -20,7 +20,7 @@ For what each configuration field means, see [the configuration reference](../re
 > **Not re-run for the file-mode revision.** The compose file now ships
 > `command: ["run", "--config=/etc/nxdns/config.zon"]`, and no container was
 > started against that command on this host: staging a release image needs
-> `zig build dist`, which refuses to run while `web/dist` is stale, and the web
+> `zig build dist`, which refuses to run while `admin/dist` is stale, and the web
 > bundle was being rebuilt by other work in the same tree at the time. What was
 > checked instead is `docker compose -f deploy/docker/compose.yaml config`,
 > which resolves the file without contacting a registry and prints the `command`
@@ -218,16 +218,16 @@ docker pull --platform linux/arm64 git.mial.net/mokhtar/nxdns:$VERSION
 The Dockerfile does not compile anything. It assembles a filesystem around binaries you build first, so build the admin interface and the release artifacts from the repository root:
 
 ```sh
-(cd web && npm ci && npm run build)
+(cd admin && npm ci && npm run build)
 VERSION=$(sed -n 's/^[[:space:]]*\.version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' build.zig.zon)
 zig build dist -Dversion-string="$VERSION" -Dgit-commit="$(git rev-parse HEAD)" \
-    -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+    -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe
 DOCKER_BUILDKIT=1 docker build -t nxdns -f deploy/docker/Dockerfile .
 ```
 
 Take the version from `build.zig.zon` rather than inventing one: `verify-dist` asserts the two agree, so a made-up string builds but fails verification. BuildKit is required — the Dockerfile pins its builder stage to `$BUILDPLATFORM`, which the classic builder does not define.
 
-Build `web/dist` every time, before the binaries. A stale bundle is embedded silently and ships an admin interface that does not match its API — which is why `dist` refuses to build against the `web/dist-placeholder` default at all.
+Build `admin/dist` every time, before the binaries. A stale bundle is embedded silently and ships an admin interface that does not match its API — which is why `dist` refuses to build against the `admin/dist-placeholder` default at all.
 
 The context has to be the repository root, because the Dockerfile copies `zig-out/dist/bin` and `zig-out/dist/stage`. The result is a `scratch` image holding the binary, a CA bundle, `/LICENSE`, `/THIRD-PARTY-NOTICES` and two empty directories.
 

docs/how-to/install-with-systemd.md

@@ -375,13 +375,13 @@ You do not need this to install nxdns, and it gets you a binary nobody has signe
 Requires Zig 0.16.0 and Node.js. From the repository root:
 
 ```sh
-(cd web && npm ci && npm run build)
+(cd admin && npm ci && npm run build)
 VERSION=$(sed -n 's/^[[:space:]]*\.version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' build.zig.zon)
 zig build dist -Dversion-string="$VERSION" -Dgit-commit="$(git rev-parse HEAD)" \
-    -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+    -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe
 ```
 
-The first command builds the admin interface into `web/dist`; the last one embeds that directory in the binary. Build the interface every time, before the binary: a stale `web/dist` ships an admin UI that does not match the API it talks to. `dist` refuses to run against the `web/dist-placeholder` default for exactly that reason, so there is no way to skip it by accident.
+The first command builds the admin interface into `admin/dist`; the last one embeds that directory in the binary. Build the interface every time, before the binary: a stale `admin/dist` ships an admin UI that does not match the API it talks to. `dist` refuses to run against the `admin/dist-placeholder` default for exactly that reason, so there is no way to skip it by accident.
 
 `-Dversion-string` is required and has no default. It is what `nxdns version` prints. Take it from `build.zig.zon` rather than inventing one: `verify-dist` asserts that the version under build equals `.version` there, so a made-up string like `0.0.0-local` builds but then fails verification. `-Dgit-commit` is what distinguishes your build from the published one of the same version.
 
@@ -398,7 +398,7 @@ Check the result the same way the release pipeline does:
 
 ```sh
 zig build verify-dist -Dversion-string="$VERSION" -Dgit-commit="$(git rev-parse HEAD)" \
-    -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+    -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe
 ```
 
 `verify-dist` extracts each archive and asserts the ELF is static and within the size budget, that the layout and file modes are exactly what step 1 lists, and that `nxdns version` prints what was built. It exits non-zero on any failure.

docs/how-to/upgrade.md

@@ -336,13 +336,13 @@ Stop the server first either way. `import` rewrites configuration underneath a p
 If you are running something you built rather than a release, step 2 is a build instead of a download:
 
 ```sh
-(cd web && npm ci && npm run build)
+(cd admin && npm ci && npm run build)
 VERSION=$(sed -n 's/^[[:space:]]*\.version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' build.zig.zon)
 zig build dist -Dversion-string="$VERSION" -Dgit-commit="$(git rev-parse HEAD)" \
-    -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+    -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe
 ```
 
-Rebuild `web/dist` before the binary on every upgrade. The admin interface is embedded at build time, and an old bundle against a new API is a broken settings page. `dist` refuses the `web/dist-placeholder` default outright, so the only way to ship a stale bundle is to leave an old `web/dist` in place.
+Rebuild `admin/dist` before the binary on every upgrade. The admin interface is embedded at build time, and an old bundle against a new API is a broken settings page. `dist` refuses the `admin/dist-placeholder` default outright, so the only way to ship a stale bundle is to leave an old `admin/dist` in place.
 
 The staged payload for each target is under `zig-out/dist/stage/nxdns-<version>-<triple>/`, and step 3 continues from there with that path in place of the extracted one. The version string has to equal `.version` in `build.zig.zon` — `verify-dist` asserts it, so a made-up one builds and then fails verification. What tells your build apart from the published release of the same version is `-Dgit-commit`, which `nxdns version` prints beside the version.
 

docs/how-to/verify-a-release.md

@@ -275,9 +275,9 @@ git clone https://git.mial.net/mokhtar/nxdns
 cd nxdns
 git checkout "v$VERSION"
 git verify-tag "v$VERSION"
-(cd web && npm ci && npm run build)
+(cd admin && npm ci && npm run build)
 zig build dist -Dversion-string="$VERSION" -Dgit-commit="$(git rev-parse HEAD)" \
-  -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+  -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe
 sha256sum zig-out/dist/nxdns-"$VERSION"-*.tar.gz
 ```