Let only admins change the global settings

BINDERY_ADMIN_USERS lists the admins of the cwa and proxy modes. Only an
admin can change the global settings and the global rules, and read or
change personal.ini. Without a list, each user is an admin.

tests/js/admin.test.mjs

@@ -0,0 +1,26 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { find, install, server, settle } from './flow-helpers.mjs';
+
+const ui = install();
+const { stopPolling } = await import('../../bindery/static/js/jobs.js');
+
+test('a user who is not an admin gets no settings link and no settings page', async (t) => {
+  t.after(stopPolling);
+  const backend = server(t);
+  backend.on('GET', 'auth/check', { authenticated: true, mode: 'proxy', user: 'bob', admin: false });
+  backend.on('GET', 'config', { metadata_fields: {}, mode_labels: {}, library_available: false });
+  backend.on('GET', 'jobs', []);
+  backend.on('GET', 'stories', []);
+  await import('../../bindery/static/js/main.js');
+  await settle();
+  assert.ok(find(ui.app, 'a', 'Stories'));
+  assert.equal(find(ui.app, 'a', 'Settings'), undefined);
+  window.location.hash = '#/settings';
+  ui.windowEvents.hashchange();
+  await settle();
+  assert.match(ui.app.textContent, /Only an admin can open the settings/);
+  // The page asks the server for no settings and no rules.
+  assert.deepEqual(backend.sent('GET', 'settings'), []);
+  assert.deepEqual(backend.sent('GET', 'rules'), []);
+});