feat: incident admin panel (v1) + MCP agent surface

[amondnet]

Context / Motivation

#62 gives operators a CLI and an authenticated API for the incident lifecycle. This issue adds a browser admin surface for the people who do not live in a terminal — during an outage, that is often exactly who is writing the update.

The admin UX is modelled on emdash-cms/emdash, but deliberately slimmed: this is a focused incident editor, not a general-purpose CMS. Everything below is scoped to incidents.

Proposed scope (v1)

• Schema-driven incident form — create, update, and resolve, with draft / published / scheduled states.
• Markdown body editor — a plain Markdown editing surface. No rich-text or TipTap-style WYSIWYG.
• Revisions with optimistic concurrency — _rev-style read-before-write, matching feat(cli,api): incident CRUD — create/update/resolve with Markdown body #62, so two operators editing the same incident during an outage cannot silently clobber each other.
• HMAC-signed, time-limited preview links — share an unpublished incident with a colleague before it goes public.

Auth

Reuse Cloudflare Access as the identity gate, per ADR-0003 (docs/adr/0003-private-pages-via-cloudflare-access.md). That ADR's decision is explicit: authentication lives at the edge, and @statusbeam/web / @statusbeam/worker ship no login, session, or authorization code. The admin panel follows the same rule — no custom auth system, no user table, no session handling in the app.

Follow-up

• MCP agent surface — expose the same incident CRUD as MCP tools, backed by the feat(cli,api): incident CRUD — create/update/resolve with Markdown body #62 API (no second write path). This fits the direction the docs site already takes: apps/docs ships llms.txt and raw-Markdown endpoints, so the project already treats AI agents as first-class consumers.

Non-goals

Explicitly out of scope for this issue — these are what make a CMS a CMS, and StatusBeam is not one:

• Media library / asset management
• Schema builder (content types are fixed: incidents)
• Plugin sandboxing
• Rich-text editor

Acceptance criteria

• An operator can run the full incident lifecycle from the admin panel, including scheduling a publish.
• A preview link renders an unpublished incident and stops working after it expires.
• Revisions are listed, an earlier revision can be inspected, and a stale write is rejected.
• Access to the admin panel is gated by Cloudflare Access; no auth code ships in the app.

Priority / Effort / Dependencies

• Priority: p2
• Effort: L (~1 week)
• Dependencies: Blocked by feat(cli,api): incident CRUD — create/update/resolve with Markdown body #62 (requires its API, revision model, and write path). Sub-issue of Epic: Incident lifecycle v1 — real incident data end-to-end #70.