feat: implement admin improvements (sortable index, filter enhancements, Sequel support, auth hardening, CSV export, config validation)

[Copilot]

Description

Implements a broad set of improvements to TinyAdmin covering interactive index sorting, richer filter types, a Sequel repository plugin, hardened authentication, CSV export, configuration validation, RBS coverage, and several bug fixes. CRUD write operations are excluded (deferred).

Sortable Column Headers (Section 2)

Index table headers are now <a> links that toggle ASC ▲ / DESC ▼. Sort params are validated against the known field list to prevent column injection.

Filter Enhancements (Section 3)

• Range filters – type: :range renders a gte/lte input pair; apply_filters maps to WHERE col >= ? AND col <= ?
• Multi-select filters – type: :select, multiple: true renders a multi-select; maps to IN (?)
• Association filters – type: :association with association:, value_field:, label_field: populates a <select> from a related model

Sequel Repository (Section 4)

New TinyAdmin::Plugins::SequelRepository implements the full repository contract for Sequel datasets (field inference via db_schema, scalar/range/multi-select filters using Sequel expressions). BaseRepository now documents its contract in full and exposes a page_offset protected helper used by both AR and Sequel implementations.

Configuration Validation (Section 5)

Settings#load_settings now validates: unknown top-level keys, invalid section type: values, and missing required repository interface methods. Warnings by default; strict_config: true raises ArgumentError.

Authentication Hardening (Section 6)

• BCrypt – SimpleAuth auto-detects $2b$/$2a$ hash prefix; SHA-512 kept for backward compat
• Rate limiting – Session-based counter; configurable max_attempts (default 5) and lockout_seconds (default 300)
• Username – Optional username: config; when set, login form must supply a matching param

CSV Export (Section 7)

New TinyAdmin::Actions::CsvExport collection action — respects field/attribute config, applies active filters, returns a text/csv attachment. Default row cap is 10,000 (configurable via max_export_limit:).

# Register as a collection action:
collection_actions:
  - csv_export: TinyAdmin::Actions::CsvExport

RBS (Section 8)

All new/changed classes have updated signatures: CsvExport, SequelRepository, SimpleAuth::BCRYPT_PREFIX, Index (show_link, sort_params), FiltersForm private helpers, Settings new constants/methods, BaseRepository#page_offset.

Bug Fixes (Section 10)

• 10a – Index no longer renders a "Show" link when only: [:index]; show_link flows Router → Action → View
• 10b – Store#add_resource_section normalises only: values to symbols, removing the string/symbol dual-check in Router
• 10c – configure_from_file accepts reset: false to preserve prior programmatic settings
• 10e – Widgets raises ArgumentError for non-Phlex::HTML widget classes instead of silently skipping