fix: Windows path handling, light theme default, file viewer in editor, first-user admin logic

Config:
- Fixed SQLite path parsing on Windows (handle drive letters without prepending /)
- Changed default theme from dark to light
- Updated OAuth test credentials (gitea_oauth_client_id/secret)

Auth:
- First real user (excluding default admin with no password) becomes admin
- Changed user count query to exclude users without password_hash

File viewer:
- Removed separate _render_file_viewer() —

app/templates/page_editor.html

@@ -1,8 +1,8 @@
-{% extends "base.html" %} {% block page_icon %}📄{% endblock %} {% block
+{% extends "base.html" %} {% block page_icon %}{% if page.content_format == 'file' %}📎{% else %}📄{% endif %}{% endblock %} {% block
 page_title %}{{ page.title }}{% endblock %} {% block topbar %}
-{% set page_icon = "📄" %}
+{% set page_icon = "📄" if page.content_format != 'file' else "📎" %}
 {% set page_title = page.title %}
-{% set right_actions = '<span class="topbar-edited" style="cursor:pointer;" @click="window.E && (window.E.activityOpen = !window.E.activityOpen)">Edited <span x-text="window.E && window.E.timeAgo || \'\'"></span> ▾</span><button class="topbar-btn share-btn" @click="window.E && (window.E.shareOpen = !window.E.shareOpen)">🔒 Share ▾</button><button class="topbar-btn" @click="window.E && window.E.copyPageLink()" title="Copy link">🔗</button><button class="topbar-btn star-btn" @click="window.E && window.E.toggleFavorite()">⭐</button><button class="topbar-btn" @click="window.E && (window.E.moreOpen = !window.E.moreOpen)" style="position:relative">⋯</button>' %}
+{% set right_actions = '<span class="topbar-edited" style="cursor:pointer;" @click="window.E && window.E.toggleActivityOpen()">Edited <span x-text="window.E && window.E.timeAgo || \'\'"></span> ▾</span><button class="topbar-btn share-btn" @click="window.E && window.E.toggleShareOpen()">🔒 Share ▾</button><button class="topbar-btn" @click="window.E && window.E.copyPageLink()" title="Copy link">🔗</button><button class="topbar-btn star-btn" @click="window.E && window.E.toggleFavorite()">⭐</button><button class="topbar-btn relative" @click="window.E && window.E.toggleMoreOpen()">⋯</button>' %}
 {% include '_header.html' %}
 {% endblock %} {% block content %}
 <div class="page-editor-wrapper" x-data="editorState()">
@@ -12,7 +12,7 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
             <div
                 class="share-dialog"
                 x-show="shareOpen"
-                @click.outside="shareOpen = false"
+                @click.outside="!_justOpened && (shareOpen = false)"
                 x-transition.opacity.scale.origin.top.right
             >
                 <!-- Header with tabs -->
@@ -336,9 +336,9 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
             <!-- ═══════════ Activity Popover ═══════════ -->
             <div class="activity-popover"
                  x-show="activityOpen"
-                 @click.outside="activityOpen = false"
+                 @click.outside="!_justOpened && (activityOpen = false)"
                  x-transition.opacity.scale.origin.top.right
-                 style="position:absolute;top:100%;right:0;margin-top:4px;background:var(--bg-secondary);border:1px solid var(--border-strong);border-radius:12px;box-shadow:0 12px 32px rgba(0,0,0,.5);z-index:1000;width:280px;padding:12px;">
+                 style="position:absolute;top:100%;right:0;margin-top:4px;background:var(--bg-modal);border:1px solid var(--border);border-radius:var(--radius-lg);box-shadow:var(--shadow-modal);z-index:1000;width:280px;padding:12px;">
                 <div style="font-size:12px;color:var(--text-secondary);margin-bottom:4px;">Edited <span x-text="timeAgo"></span></div>
                 <template x-if="pageCreated">
                   <div style="font-size:12px;color:var(--text-tertiary);">Created <span x-text="formatDate(pageCreated)"></span></div>
@@ -349,7 +349,7 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
             <div
                 class="more-menu"
                 x-show="moreOpen"
-                @click.outside="moreOpen = false"
+                @click.outside="!_justOpened && (moreOpen = false)"
                 x-transition
             >
                 <div class="more-menu-item" @click="exportPage">↗ Export</div>
@@ -368,7 +368,7 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
                  x-show="moveOpen"
                  @click.outside="moveOpen = false"
                  x-transition.opacity.scale
-                 style="position:absolute;top:100%;right:0;margin-top:4px;background:var(--bg-secondary);border:1px solid var(--border-strong);border-radius:12px;box-shadow:0 12px 32px rgba(0,0,0,.5);z-index:1000;width:320px;padding:16px;">
+                 style="position:absolute;top:100%;right:0;margin-top:4px;background:var(--bg-modal);border:1px solid var(--border);border-radius:var(--radius-lg);box-shadow:var(--shadow-modal);z-index:1000;width:320px;padding:16px;">
                 <h3 style="font-size:14px;margin-bottom:12px;">Move to workspace</h3>
                 <div x-show="moveLoading" style="color:var(--text-tertiary);text-align:center;padding:20px;">Loading...</div>
                 <div x-show="!moveLoading" style="max-height:240px;overflow-y:auto;">
@@ -390,7 +390,7 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
     <!-- ═══════════ Page Content ═══════════ -->
     <div class="page-cover-area">
         <div class="page-title-block">
-            <span class="page-icon-emoji">📄</span>
+            <span class="page-icon-emoji">{% if page.content_format == 'file' %}📎{% else %}📄{% endif %}</span>
             <div
                 class="page-title-input"
                 contenteditable="true"
@@ -523,6 +523,7 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
     {{ page_data | tojson }}
 </script>
 <script>
+/* eslint-disable */
     const CMDS=[{name:'BASIC',items:[
       {id:'paragraph',name:'Text',icon:'¶'},{id:'heading_1',name:'Heading 1',icon:'H1'},{id:'heading_2',name:'Heading 2',icon:'H2'},
       {id:'heading_3',name:'Heading 3',icon:'H3'},{id:'heading_4',name:'Heading 4',icon:'H4'},{id:'bulleted_list',name:'Bulleted list',icon:'•'},{id:'numbered_list',name:'Numbered list',icon:'1.'},
@@ -572,6 +573,14 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
 
     function renderBlock(b,idx){
       if(b.type==='divider')return `<div class="block-wrapper"><hr class="block-divider"></div>`;
+      if(b.type==='image')return `<div class="block-wrapper"><div class="block-content block-image" style="text-align:center;padding:12px 0;"><img src="${b.src||''}" alt="${esc(b.alt||'')}" style="max-width:100%;max-height:70vh;border-radius:8px;display:block;margin:0 auto;" onerror="this.style.display='none';this.parentElement.innerHTML='<div style=\\'padding:40px;color:var(--text-tertiary)\\'>Image not found</div>'"></div></div>`;
+      if(b.type==='embed'){
+        if(b.embed_type==='pdf')return `<div class="block-wrapper"><div class="block-content block-embed" style="padding:0;"><iframe src="${b.src||''}" style="width:100%;height:80vh;border:none;border-radius:8px;"></iframe></div></div>`;
+        if(b.embed_type==='download'){
+          var sz=b.file_size||0;var szStr=sz<1024?sz+' B':sz<1048576?(sz/1024).toFixed(1)+' KB':(sz/1048576).toFixed(1)+' MB';
+          return `<div class="block-wrapper"><div class="block-content block-embed" style="text-align:center;padding:60px 20px;"><div style="font-size:48px;margin-bottom:12px;">📎</div><div style="font-size:16px;font-weight:500;color:var(--text-primary);margin-bottom:4px;">${esc(b.file_name||'File')}</div><div style="font-size:12px;color:var(--text-tertiary);margin-bottom:16px;">${szStr} · ${esc(b.file_mime||'')}</div><a href="${b.src||''}" download style="display:inline-block;padding:8px 20px;background:var(--accent);color:#fff;text-decoration:none;border-radius:8px;font-size:13px;font-weight:500;">⬇ Download</a></div></div>`;
+        }
+      }
       const ph=b.type==='heading_1'?'Heading 1':b.type==='heading_2'?'Heading 2':b.type==='heading_3'?'Heading 3':b.type==='heading_4'?'Heading 4':b.type==='bulleted_list'?'List':b.type==='numbered_list'?'List':b.type==='to_do'?'To-do':b.type==='toggle'?'Toggle list':b.type==='quote'?'Empty quote':b.type==='code'?'Type code...':b.type==='callout'?'Type something...':'Press \'/\' for commands...';
       let inner='';
       if(b.type==='to_do')inner=`<input type="checkbox" class="todo-checkbox" ${b.checked?'checked':''} onchange="E._doToggle('${b.id}',this.checked)"><div data-bid="${b.id}" contenteditable="true" data-placeholder="${ph}" spellcheck="false">${esc(b.content)}</div>`;
@@ -623,7 +632,8 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
           _bid=Math.floor(Math.random()*10000);
           const dataEl=document.getElementById('page-data');
           if(dataEl){try{const data=JSON.parse(dataEl.textContent);this.pid=data.id;this.pageTitle=data.title||'';this.favorited=data.favorited||false;const fmt=data.content_format||'blocks';const raw=data.content||'';
-          if(fmt==='blocks'&&raw){try{this.blocks=JSON.parse(raw);this.blocks.forEach(b=>{if(!b.id)b.id=genId()});}catch(e){this.blocks=[];}}
+          if(fmt==='file'){this.fileData=data;this.loadFileContent(data);}
+          else if(fmt==='blocks'&&raw){try{this.blocks=JSON.parse(raw);this.blocks.forEach(b=>{if(!b.id)b.id=genId()});}catch(e){this.blocks=[];}}
           else if(raw&&raw.trim())this.blocks=this.md2b(raw);}catch(e){}}
           if(!this.blocks.length)this.blocks=[this.mkB('paragraph','')];
           window.E=this;SM.init();this.render();
@@ -633,13 +643,36 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
             if(typeof Sortable!=='undefined')Sortable.create(ct,{draggable:'.block-wrapper',handle:'.block-handle',animation:150,ghostClass:'sortable-ghost',dragClass:'sortable-drag',onEnd:evt=>{if(evt.oldIndex===evt.newIndex)return;const[item]=this.blocks.splice(evt.oldIndex,1);this.blocks.splice(evt.newIndex,0,item);this.dirty=true;this.autoSave();this.render();}});
           },100);
         },
+        fileData:null,
+        async loadFileContent(data){
+          const url=data.file_url||'';const mime=data.file_mime||'';const name=data.file_name||'';const self=this;
+          if(!url){this.blocks=[this.mkB('paragraph','File not available')];this.render();return;}
+          const ext=name.toLowerCase().split('.').pop();
+          if(mime.startsWith('image/')||['png','jpg','jpeg','gif','webp','svg','bmp','ico'].includes(ext)){
+            this.blocks=[this.mkB('image','',{src:url,alt:name})];this.render();return;
+          }
+          if(mime==='application/pdf'||ext==='pdf'){
+            this.blocks=[this.mkB('embed','',{src:url,embed_type:'pdf'})];this.render();return;
+          }
+          const codeExts=['py','js','ts','jsx','tsx','html','htm','css','json','xml','yaml','yml','md','markdown','sql','sh','bash','ps1','bat','cmd','rb','go','rs','java','c','cpp','h','hpp','php','swift','kt','scala','r','toml','ini','cfg','conf','env','txt','log'];
+          const langMap={'py':'python','js':'javascript','ts':'typescript','jsx':'javascript','tsx':'typescript','html':'html','htm':'html','css':'css','json':'json','xml':'xml','yaml':'yaml','yml':'yaml','md':'markdown','markdown':'markdown','sql':'sql','sh':'bash','bash':'bash','ps1':'powershell','bat':'plaintext','cmd':'plaintext','rb':'ruby','go':'go','rs':'rust','java':'java','c':'c','cpp':'cpp','h':'c','hpp':'cpp','php':'php','swift':'swift','kt':'kotlin','scala':'scala','r':'r','toml':'toml','ini':'ini','cfg':'ini','conf':'ini','env':'ini','txt':'plaintext','log':'plaintext'};
+          if(mime.startsWith('text/')||codeExts.includes(ext)){
+            try{const r=await fetch(url);const text=await r.text();
+              if(ext==='md'||ext==='markdown'){this.blocks=this.md2b(text);}
+              else{this.blocks=[this.mkB('code',text,{language:langMap[ext]||'Plain Text'})];}
+              this.render();
+            }catch(e){this.blocks=[this.mkB('paragraph','Error loading file: '+e.message)];this.render();}
+            return;
+          }
+          this.blocks=[this.mkB('embed','',{src:url,embed_type:'download',file_name:name,file_size:data.file_size||0,file_mime:mime})];this.render();
+        },
         mkB(type,content,extras){const b={id:genId(),type,content:content||'',...(extras||{})};if(type==='toggle')b.expanded=true;if(type==='to_do')b.checked=false;return b;},
         getEl(bid){const ct=document.getElementById('_blocksCt');return ct?ct.querySelector(`[data-bid="${bid}"]`):null;},
         getIdx(bid){return this.blocks.findIndex(b=>b.id===bid);},
         getActiveBlock(){const el=document.activeElement;if(!el||!el.hasAttribute('data-bid'))return null;return{el,bid:el.dataset.bid,idx:this.getIdx(el.dataset.bid)};},
         focusBlock(){const b=this.blocks[0];if(!b)return;const el=this.getEl(b.id);if(el){el.focus();ce(el);}},
         onCtClick(e){if(e.target===document.getElementById('_blocksCt')||e.target?.classList?.contains('blocks-empty')){if(!this.blocks.length)this.addAt(0);else{const b=this.blocks[this.blocks.length-1];const el=b&&this.getEl(b.id);if(el){el.focus();ce(el);}}}},
-        sync(){const ct=document.getElementById('_blocksCt');if(!ct)return;for(const b of this.blocks){if(b.type==='divider')continue;const el=ct.querySelector(`[data-bid="${b.id}"]`);if(el)b.content=el.textContent||'';}},
+        sync(){const ct=document.getElementById('_blocksCt');if(!ct)return;for(const b of this.blocks){if(b.type==='divider'||b.type==='image'||b.type==='embed')continue;const el=ct.querySelector(`[data-bid="${b.id}"]`);if(el)b.content=el.textContent||'';}},
         render(){const ct=document.getElementById('_blocksCt');if(!ct)return;let html='';for(let i=0;i<this.blocks.length;i++)html+=renderBlock(this.blocks[i],i);ct.innerHTML=html;
           ct.querySelectorAll('.block-wrapper').forEach(w=>{w.onmouseenter=()=>{w.querySelector('.block-handle')?.classList.add('visible');w.querySelector('.block-actions')?.classList.add('visible');};w.onmouseleave=()=>{w.querySelector('.block-handle')?.classList.remove('visible');w.querySelector('.block-actions')?.classList.remove('visible');};});
           ct.querySelectorAll('[data-placeholder]').forEach(el=>{el.innerHTML=el.innerHTML.replace(/<br[^>]*>/gi,'').trim()!==''?el.innerHTML:'';el.classList.toggle('empty',!el.textContent.trim());});
@@ -653,14 +686,28 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
           const csrf=document.cookie.match(/csrf_token=([^;]+)/);
           const m=this.favorited?'DELETE':'POST';
           fetch(`/board/api/favorites/${this.pid}`,{method:m,headers:{'X-CSRF-Token':csrf?csrf[1]:''}})
-            .then(r=>r.json()).then(()=>{this.favorited=!this.favorited;}).catch(()=>{});
+            .then(r=>r.json()).then(()=>{this.favorited=!this.favorited;this.showToast(this.favorited?'Added to favorites':'Removed from favorites');}).catch(()=>{this.showToast('Failed to toggle favorite');});
         },
+        toggleActivityOpen(){
+          if(!this.activityOpen){this.activityOpen=true;this._justOpened=true;setTimeout(()=>this._justOpened=false,200);}
+          else{this.activityOpen=false;}
+        },
+        toggleShareOpen(){
+          if(!this.shareOpen){this.shareOpen=true;this._justOpened=true;setTimeout(()=>this._justOpened=false,200);}
+          else{this.shareOpen=false;}
+        },
+        toggleMoreOpen(){
+          if(!this.moreOpen){this.moreOpen=true;this._justOpened=true;setTimeout(()=>this._justOpened=false,200);}
+          else{this.moreOpen=false;}
+        },
+        _justOpened:false,
         togglePublish(){this.pagePublished=!this.pagePublished;this.saveShare();},
         saveShare(){
           const csrf=document.cookie.match(/csrf_token=([^;]+)/);
           fetch(`/board/api/share/${this.pid}`,{method:'POST',headers:{'Content-Type':'application/json','X-CSRF-Token':csrf?csrf[1]:''},body:JSON.stringify({mode:this.generalAccess,published:this.pagePublished})}).catch(()=>{});
         },
-        copyPageLink(){
+        async copyPageLink(){
+          console.log('copyPageLink invoked');
           const url = this.pageUrl;
           const fallback = () => {
             const ta = document.createElement('textarea');
@@ -669,9 +716,8 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
             document.execCommand('copy'); document.body.removeChild(ta);
           };
           try {
-            navigator.clipboard.writeText(url).then(() => {
-              this.showToast('Link copied to clipboard');
-            }).catch(() => { fallback(); this.showToast('Link copied to clipboard'); });
+            await navigator.clipboard.writeText(url);
+            this.showToast('Link copied to clipboard');
           } catch(e) { fallback(); this.showToast('Link copied to clipboard'); }
         },
         showToast(msg){
@@ -839,8 +885,9 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
         fmtApply(f){this.fmt.open=false;if(!this._sel)return;const s=window.getSelection();s.removeAllRanges();s.addRange(this._sel.range);document.execCommand(f==='strikeThrough'?'strikeThrough':f);this._sel=null;this.dirty=true;this.autoSave();},
         fmtLink(){this.fmt.open=false;const u=prompt('URL:');if(u){document.execCommand('createLink',false,u);this.dirty=true;this.autoSave();}},
         pastePlain(e){e.preventDefault();document.execCommand('insertText',false,(e.clipboardData||window.clipboardData).getData('text/plain'));this.dirty=true;this.autoSave();},
-        autoSave(){clearTimeout(this.st);this.st=setTimeout(()=>this.save(),1500);},
+        autoSave(){if(this.fileData)return;clearTimeout(this.st);this.st=setTimeout(()=>this.save(),1500);},
         save(){
+          if(this.fileData)return;
           if(this.saving)return;
           this.sync();
           const t=document.getElementById('_titleEl');if(t)this.pageTitle=t.textContent?.trim()||'New page';