fix: Windows path handling, light theme default, file viewer in editor, first-user admin logic

Config:
- Fixed SQLite path parsing on Windows (handle drive letters without prepending /)
- Changed default theme from dark to light
- Updated OAuth test credentials (gitea_oauth_client_id/secret)

Auth:
- First real user (excluding default admin with no password) becomes admin
- Changed user count query to exclude users without password_hash

File viewer:
- Removed separate _render_file_viewer() —

app/routers/auth.py

@@ -153,9 +153,11 @@ async def register(request: Request):
         if existing:
             from fastapi.responses import JSONResponse
             return JSONResponse({"error": "Account already exists"}, status_code=409)
-        # First user is admin
-        user_count = conn.execute("SELECT COUNT(*) FROM users").fetchone()[0]
-        is_admin = 1 if user_count == 0 else 0
+        # First real user (excluding default admin with no password) is admin
+        real_user_count = conn.execute(
+            "SELECT COUNT(*) FROM users WHERE password_hash IS NOT NULL AND password_hash != ''"
+        ).fetchone()[0]
+        is_admin = 1 if real_user_count == 0 else 0
         conn.execute(
             "INSERT INTO users (login, full_name, email, password_hash, is_admin) VALUES (?, ?, ?, ?, ?)",
             (email, name, email, hash_password(password), is_admin),

app/routers/board.py

@@ -926,10 +926,6 @@ async def view_page(request: Request, page_id: int):
             return HTMLResponse("<h2>Page not found</h2>", status_code=404)
     page = dict(row)
 
-    # ── File viewer for uploaded files ──
-    if page.get("content_format") == "file":
-        return _render_file_viewer(page, request)
-
     ws = page.get("workspace", "")
     parts = ws.split("/") if "/" in ws else ["", ""]
     owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
@@ -941,10 +937,38 @@ async def view_page(request: Request, page_id: int):
         fav = conn.execute(
             "SELECT id FROM favorites WHERE user_id=? AND page_id=?", (uid, page_id)
         ).fetchone()
+
+    # Build page_data, including file metadata for uploaded files
+    page_data = {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0))}
+
+    # For file pages, extract file metadata and add to page_data
+    if page.get("content_format") == "file":
+        import json as _json
+        try:
+            meta = _json.loads(page.get("content", "{}"))
+        except _json.JSONDecodeError:
+            meta = {}
+        file_path = meta.get("file_path", "").replace("\\", "/")
+        mime_type = meta.get("mime_type", "application/octet-stream")
+        file_size = meta.get("size", 0)
+        # Build workspace_id from file_path
+        fp_parts = file_path.split("/")
+        ws_id = ""
+        for p in fp_parts:
+            if p.startswith("workspace_"):
+                ws_id = p.replace("workspace_", "")
+                break
+        filename = fp_parts[-1] if fp_parts else page.get("title", "File")
+        file_url = f"/api/files/{ws_id}/{filename}" if ws_id else ""
+        page_data["file_url"] = file_url
+        page_data["file_mime"] = mime_type
+        page_data["file_size"] = file_size
+        page_data["file_name"] = filename
+
     ctx = {**sidebar, "page": page, "page_favorited": fav is not None,
            "page_share_mode": page.get("share_mode", "private"),
            "page_published": bool(page.get("published", 0)),
-           "page_data": {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0))}}
+           "page_data": page_data}
     template = env.get_template("page_editor.html")
     response = template.render(**ctx)
     return HTMLResponse(content=response, headers={"Cache-Control": "no-store, max-age=0"})

app/routers/dashboard.py

@@ -216,7 +216,6 @@ async def view_page_root(request: Request, page_id: int):
     """Render a Markdown page at root level with workspace context — or file viewer."""
     from jinja2 import Environment, FileSystemLoader
     from app.routers.board import _sidebar_data as board_sidebar
-    from app.routers.board import _render_file_viewer
     env = Environment(loader=FileSystemLoader("app/templates"))
     with get_conn() as conn:
         row = conn.execute("SELECT * FROM pages WHERE id=?", (page_id,)).fetchone()
@@ -224,9 +223,6 @@ async def view_page_root(request: Request, page_id: int):
             return HTMLResponse("<h2>Page not found</h2>", status_code=404)
     page = dict(row)
 
-    # ── File viewer for uploaded files ──
-    if page.get("content_format") == "file":
-        return _render_file_viewer(page, request)
     ws = page.get("workspace", "")
     parts = ws.split("/") if "/" in ws else ["", ""]
     owner, repo = parts[0], parts[1] if len(parts) > 1 else ""
@@ -237,11 +233,42 @@ async def view_page_root(request: Request, page_id: int):
             "SELECT id, title FROM pages WHERE parent_id=? ORDER BY updated_at DESC",
             (page_id,),
         ).fetchall()
+        fav = conn.execute(
+            "SELECT id FROM favorites WHERE user_id=? AND page_id=?",
+            (1, page_id),
+        ).fetchone()
+
+    # Build page_data, including file metadata for uploaded files
+    page_data = {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": fav is not None, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0))}
+
+    # For file pages, extract file metadata and add to page_data
+    if page.get("content_format") == "file":
+        import json as _json
+        try:
+            meta = _json.loads(page.get("content", "{}"))
+        except _json.JSONDecodeError:
+            meta = {}
+        file_path = meta.get("file_path", "").replace("\\", "/")
+        mime_type = meta.get("mime_type", "application/octet-stream")
+        file_size = meta.get("size", 0)
+        fp_parts = file_path.split("/")
+        ws_id = ""
+        for p in fp_parts:
+            if p.startswith("workspace_"):
+                ws_id = p.replace("workspace_", "")
+                break
+        filename = fp_parts[-1] if fp_parts else page.get("title", "File")
+        file_url = f"/api/files/{ws_id}/{filename}" if ws_id else ""
+        page_data["file_url"] = file_url
+        page_data["file_mime"] = mime_type
+        page_data["file_size"] = file_size
+        page_data["file_name"] = filename
+
     ctx = {**sidebar, "page": page, "sub_pages": [dict(s) for s in subs],
-           "page_favorited": False,
+           "page_favorited": fav is not None,
            "page_share_mode": page.get("share_mode", "private"),
            "page_published": bool(page.get("published", 0)),
-           "page_data": {"id": page_id, "title": page.get("title"), "content_format": page.get("content_format", "blocks"), "content": page.get("content", ""), "favorited": False, "share_mode": page.get("share_mode", "private"), "published": bool(page.get("published", 0))}}
+           "page_data": page_data}
     template = env.get_template("page_editor.html")
     response = template.render(**ctx)
     return HTMLResponse(content=response, headers={"Cache-Control": "no-store, max-age=0"})
@@ -866,8 +893,11 @@ async def serve_uploaded_file(ws_id: int, filename: str):
     """Serve an uploaded file from disk."""
     from pathlib import Path
     import mimetypes
-    fp = Path(f"/data/uploads/workspace_{ws_id}/{filename}").resolve()
-    if not str(fp).startswith(f"/data/uploads/workspace_{ws_id}/"):
+    base_dir = Path(f"/data/uploads/workspace_{ws_id}").resolve()
+    fp = (base_dir / filename).resolve()
+    try:
+        fp.relative_to(base_dir)
+    except ValueError:
         return JSONResponse({"error": "Path traversal denied"}, status_code=403)
     if not fp.exists():
         return JSONResponse({"error": "File not found"}, status_code=404)