M3: chat widget, owner dashboard, super-admin panel

- Embeddable vanilla-JS chat widget (one script tag + tenant public key):
  WebSocket, resumable sessions (24h localStorage token), honeypot + per-IP
  and per-message rate limits, Bosnian UI (§7)
- Session auth (bcrypt + signed cookies), owner accounts + super-admins,
  admin impersonation ('otvori kao salon', §11)
- Owner dashboard (§10, Bosnian): requests with same actions as email,
  call/chat history with transcripts, usage bar; settings for profile,
  working hours (manual + LLM paste-to-parse), services CRUD + 'Zalijepi
  cjenovnik' LLM import with review step, scheduling (Google OAuth free/busy
  read-only + calendar mappings + buffers, partner status), telephony
  (forwarding MMI codes per operator, ring group, worker SIP creds + QR),
  agent voice/price-mode/notes + widget snippet, notifications/SMS templates
- Super-admin panel (§11): tenant CRUD incl. plan/minutes/paid-until,
  partner API config (encrypted secrets), number/SIM registry + assignment,
  connectivity test (live availability + dry-run push), versioned prompt
  template editor with publish/rollback, playground, usage overview, health
- Fixes: WAL + busy_timeout for sqlite tests, no awaits in WS disconnect
  path (deadlock), template publish autoflush bug
- 76 tests green (incl. widget WS e2e booking flow); dashboard, widget and
  admin verified live in a browser against Postgres

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

gogo/templates/admin/_nav.html

@@ -0,0 +1,12 @@
+<header>
+  <div class="logo">Gogo <span>Admin</span></div>
+  <nav>
+    <a href="/admin" class="{{ 'active' if active=='tenants' }}">Saloni</a>
+    <a href="/admin/numbers" class="{{ 'active' if active=='numbers' }}">Brojevi/SIM</a>
+    <a href="/admin/templates" class="{{ 'active' if active=='templates' }}">Prompt šablon</a>
+    <a href="/admin/playground" class="{{ 'active' if active=='playground' }}">Playground</a>
+    <a href="/admin/usage" class="{{ 'active' if active=='usage' }}">Potrošnja</a>
+    <a href="/admin/health" class="{{ 'active' if active=='health' }}">Sistem</a>
+  </nav>
+  <div class="right">{{ admin.email }} · <a href="/admin/logout">Odjava</a></div>
+</header>

gogo/templates/admin/health.html

@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+{% block title %}Sistem — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<h1>Zdravlje sistema (§11)</h1>
+<div class="grid2">
+  <div class="card">
+    <h2>Servisi</h2>
+    <table>
+      <tr><td>Baza podataka</td><td><span class="badge {{ 'confirmed' if db_ok else 'rejected' }}">{{ 'OK' if db_ok else 'GREŠKA' }}</span></td></tr>
+      <tr><td>LLM API ključ</td><td><span class="badge {{ 'confirmed' if llm_configured else 'pending' }}">{{ 'postavljen' if llm_configured else 'nije postavljen' }}</span></td></tr>
+      <tr><td>Email (SMTP)</td><td><span class="badge {{ 'confirmed' if email_mode=='smtp' else 'pending' }}">{{ email_mode }}</span></td></tr>
+      <tr><td>SMS provajder</td><td><span class="badge {{ 'confirmed' if sms_mode=='gsm_gateway' else 'pending' }}">{{ sms_mode }}</span></td></tr>
+      <tr><td>Voice pipeline</td><td><span class="badge {{ voice_badge }}">{{ voice_status }}</span></td></tr>
+    </table>
+  </div>
+  <div class="card">
+    <h2>Greške u slanju (zadnjih 7 dana)</h2>
+    <table>
+      <tr><td>Email greške</td><td>{{ email_errors }}</td></tr>
+      <tr><td>SMS greške</td><td>{{ sms_errors }}</td></tr>
+    </table>
+  </div>
+</div>
+{% if failed_rows %}
+<div class="card">
+  <h2>Zadnje greške</h2>
+  <table>
+    <tr><th>Vrijeme</th><th>Tip</th><th>Prima</th><th>Greška</th></tr>
+    {% for f in failed_rows %}
+    <tr><td class="muted">{{ f.at.strftime('%d.%m. %H:%M') }}</td><td>{{ f.kind }}</td>
+        <td>{{ f.to }}</td><td class="muted">{{ f.error[:120] }}</td></tr>
+    {% endfor %}
+  </table>
+</div>
+{% endif %}
+{% endblock %}

gogo/templates/admin/login.html

@@ -0,0 +1,16 @@
+{% extends "base.html" %}
+{% block title %}Admin prijava — Gogo Telefon{% endblock %}
+{% block content %}
+<div style="max-width:380px;margin:60px auto">
+  <div class="card">
+    <h1 style="margin-top:0">Gogo <span style="color:var(--brand)">Admin</span></h1>
+    <form method="post" action="/admin/login">
+      <label>Email</label>
+      <input type="email" name="email" required autofocus>
+      <label>Lozinka</label>
+      <input type="password" name="password" required>
+      <div style="margin-top:16px"><button style="width:100%">Prijavi se</button></div>
+    </form>
+  </div>
+</div>
+{% endblock %}

gogo/templates/admin/numbers.html

@@ -0,0 +1,48 @@
+{% extends "base.html" %}
+{% block title %}Brojevi/SIM — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<h1>Brojevi i SIM kartice (GSM gateway)</h1>
+<div class="card">
+<table>
+  <tr><th>Broj</th><th>Gateway port</th><th>Operater</th><th>SIM status</th><th>Salon</th><th></th></tr>
+  {% for row in rows %}
+  <tr>
+    <form method="post" action="/admin/numbers/{{ row.n.id }}">
+    <td><code>{{ row.n.msisdn }}</code></td>
+    <td style="width:110px"><input type="number" name="gateway_port" value="{{ row.n.gateway_port if row.n.gateway_port is not none }}"></td>
+    <td style="width:140px">
+      <select name="operator">
+        <option value="">?</option>
+        {% for op, label in operators.items() %}
+        <option value="{{ op }}" {{ 'selected' if row.n.operator==op }}>{{ label }}</option>
+        {% endfor %}
+      </select>
+    </td>
+    <td style="width:140px">
+      <select name="sim_status">
+        {% for s in ['unassigned','active','blocked','testing'] %}
+        <option value="{{ s }}" {{ 'selected' if row.n.sim_status==s }}>{{ s }}</option>
+        {% endfor %}
+      </select>
+    </td>
+    <td>{{ row.tenant_name or '—' }}</td>
+    <td style="white-space:nowrap"><button class="small">Sačuvaj</button></form>
+      <form method="post" action="/admin/numbers/{{ row.n.id }}/delete" style="display:inline"
+        onsubmit="return confirm('Obrisati broj?')"><button class="small red">Obriši</button></form></td>
+  </tr>
+  {% endfor %}
+  <tr>
+    <form method="post" action="/admin/numbers">
+    <td><input type="text" name="msisdn" placeholder="+38765XXXXXX" required></td>
+    <td><input type="number" name="gateway_port" placeholder="1"></td>
+    <td><select name="operator"><option value="">?</option>
+      {% for op, label in operators.items() %}<option value="{{ op }}">{{ label }}</option>{% endfor %}
+    </select></td>
+    <td></td><td></td>
+    <td><button class="small green">Dodaj</button></td>
+    </form>
+  </tr>
+</table>
+</div>
+{% endblock %}

gogo/templates/admin/playground.html

@@ -0,0 +1,51 @@
+{% extends "base.html" %}
+{% block title %}Playground — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<h1>Test playground (§11)</h1>
+<p class="muted">Tekstualni razgovor s asistentom pojedinog salona — koristi njegov sastavljeni
+prompt, usluge i provajdera termina. Zahtjevi kreirani ovdje se <b>zaista</b> šalju (koristite
+demo salon za igranje).</p>
+
+<div class="card">
+  <form method="post" action="/admin/playground">
+    <label>Salon</label>
+    <select name="tenant_id" {{ 'disabled' if history_json != '[]' }}>
+      {% for tn in tenants %}
+      <option value="{{ tn.id }}" {{ 'selected' if selected_tenant and tn.id==selected_tenant.id }}>{{ tn.name }} ({{ tn.scheduling_provider }})</option>
+      {% endfor %}
+    </select>
+    {% if history_json != '[]' %}<input type="hidden" name="tenant_id" value="{{ selected_tenant.id }}">{% endif %}
+    <label>Kanal</label>
+    <select name="channel">
+      <option value="voice" {{ 'selected' if channel=='voice' }}>voice (telefon)</option>
+      <option value="chat" {{ 'selected' if channel=='chat' }}>chat</option>
+    </select>
+
+    {% if transcript %}
+    <div class="transcript" style="margin:16px 0">
+      {% for t in transcript %}
+        <div class="t {{ t.role }}">{{ t.text }}</div>
+        {% if t.tool_calls %}<div class="tools">⚙ {% for tc in t.tool_calls %}{{ tc.name }}({{ tc.input | tojson }}) {% endfor %}</div>{% endif %}
+      {% endfor %}
+    </div>
+    {% endif %}
+
+    <input type="hidden" name="history" value="{{ history_json | e }}">
+    <label>Poruka klijenta</label>
+    <input type="text" name="message" placeholder="npr. Htjela bih zakazati šišanje u srijedu" autofocus>
+    <div style="margin-top:12px">
+      <button>Pošalji</button>
+      <a class="btn ghost" href="/admin/playground">Novi razgovor</a>
+    </div>
+  </form>
+  {% if error %}<div class="msg error" style="margin-top:12px">{{ error }}</div>{% endif %}
+</div>
+
+{% if system_prompt %}
+<details class="card">
+  <summary style="cursor:pointer;font-weight:600">Sastavljeni system prompt</summary>
+  <pre style="white-space:pre-wrap">{{ system_prompt }}</pre>
+</details>
+{% endif %}
+{% endblock %}

gogo/templates/admin/templates.html

@@ -0,0 +1,46 @@
+{% extends "base.html" %}
+{% block title %}Prompt šablon — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<h1>Globalni prompt šablon (§6.3)</h1>
+<p class="muted">Šablon vrijedi za sve salone odjednom. Dostupne oznake:
+<code>{salon_profile}</code> <code>{working_hours}</code> <code>{services_table}</code>
+<code>{notes}</code> <code>{price_mode}</code> <code>{greeting}</code>
+<code>{current_datetime}</code></p>
+
+<div class="card">
+  <h2>Nova verzija</h2>
+  <form method="post" action="/admin/templates">
+    <textarea name="body" style="min-height:340px;font-family:monospace">{{ draft_body }}</textarea>
+    <label>Bilješka o izmjeni</label>
+    <input type="text" name="notes" placeholder="npr. dodano pravilo o kućnim posjetama">
+    <label><input type="checkbox" name="publish" checked style="width:auto"> Objavi odmah (postaje aktivna verzija)</label>
+    <button style="margin-top:12px">Sačuvaj verziju</button>
+  </form>
+</div>
+
+<div class="card">
+  <h2>Verzije</h2>
+  <table>
+    <tr><th>Verzija</th><th>Datum</th><th>Bilješka</th><th>Status</th><th></th></tr>
+    {% for v in versions %}
+    <tr>
+      <td>v{{ v.version }}</td>
+      <td class="muted">{{ v.created_at.strftime('%d.%m.%Y. %H:%M') }}</td>
+      <td>{{ v.notes }}</td>
+      <td>{% if v.published %}<span class="badge confirmed">aktivna</span>{% endif %}</td>
+      <td style="white-space:nowrap">
+        <a class="btn small ghost" href="/admin/templates?load={{ v.version }}">Učitaj u editor</a>
+        {% if not v.published %}
+        <form method="post" action="/admin/templates/{{ v.version }}/publish" style="display:inline">
+          <button class="small green">Objavi (rollback)</button>
+        </form>
+        {% endif %}
+      </td>
+    </tr>
+    {% else %}
+    <tr><td colspan="5" class="muted">Nema sačuvanih verzija — koristi se ugrađeni zadani šablon.</td></tr>
+    {% endfor %}
+  </table>
+</div>
+{% endblock %}

gogo/templates/admin/tenant_edit.html

@@ -0,0 +1,109 @@
+{% extends "base.html" %}
+{% block title %}{{ t.name if t else 'Novi salon' }} — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<p><a href="/admin">← Svi saloni</a></p>
+<h1>{{ t.name if t else 'Novi salon' }}</h1>
+
+<form method="post" action="{{ '/admin/tenants/' + (t.id|string) if t else '/admin/tenants/new' }}">
+<div class="grid2">
+  <div class="card">
+    <h2>Osnovno</h2>
+    <label>Naziv</label><input type="text" name="name" value="{{ t.name if t }}" required>
+    <label>Slug <small>(kratki id, bez razmaka)</small></label>
+    <input type="text" name="slug" value="{{ t.slug if t }}" {{ 'readonly' if t }} required>
+    <label>Grad</label><input type="text" name="city" value="{{ t.city if t }}">
+    <label>Status</label>
+    <select name="status">
+      <option value="active" {{ 'selected' if t and t.status=='active' }}>aktivan</option>
+      <option value="disabled" {{ 'selected' if t and t.status=='disabled' }}>isključen</option>
+    </select>
+    {% if not t %}
+    <label>Email vlasnika <small>(kreira se nalog)</small></label>
+    <input type="email" name="owner_email" required>
+    <label>Lozinka vlasnika</label>
+    <input type="text" name="owner_password" required>
+    {% endif %}
+  </div>
+  <div class="card">
+    <h2>Plan i naplata (§12)</h2>
+    <label>Plan</label>
+    <input type="text" name="plan" value="{{ t.plan if t else 'gogo_start' }}">
+    <label>Uključene minute mjesečno</label>
+    <input type="number" name="included_minutes" value="{{ t.included_minutes if t else 300 }}">
+    <label>Plaćeno do <small>(YYYY-MM-DD, prazno = nije plaćeno)</small></label>
+    <input type="text" name="paid_until" value="{{ t.paid_until.strftime('%Y-%m-%d') if t and t.paid_until }}">
+    <label><input type="checkbox" name="hard_cutoff" {{ 'checked' if t and t.hard_cutoff }} style="width:auto">
+      Tvrdi prekid na 100% minuta (zadano: isključeno — asistent uvijek odgovara)</label>
+    <label>LLM model <small>(prazno = globalno zadani)</small></label>
+    <input type="text" name="llm_model" value="{{ t.llm_model if t }}">
+    <label>TTL prijedloga (sati)</label>
+    <input type="number" name="proposal_ttl_hours" value="{{ t.proposal_ttl_hours if t else 24 }}">
+  </div>
+</div>
+
+<div class="card">
+  <h2>Provajder termina (§8)</h2>
+  <label>Tip</label>
+  <select name="scheduling_provider">
+    <option value="google_calendar" {{ 'selected' if t and t.scheduling_provider=='google_calendar' }}>google_calendar</option>
+    <option value="partner_api" {{ 'selected' if t and t.scheduling_provider=='partner_api' }}>partner_api</option>
+    <option value="mock" {{ 'selected' if t and t.scheduling_provider=='mock' }}>mock (demo/test)</option>
+  </select>
+  <div class="grid2">
+    <div>
+      <label>Partner: base URL</label>
+      <input type="url" name="partner_base_url" value="{{ pconfig.get('base_url','') }}" placeholder="https://booking.salon.ba/gogo/v1">
+      <label>Partner: API ključ <small>(prazno = ne mijenjaj)</small></label>
+      <input type="text" name="partner_api_key" placeholder="{{ '•••• postavljen' if pconfig.get('api_key_encrypted') else '' }}">
+      <label>Partner: webhook secret <small>(prazno = ne mijenjaj)</small></label>
+      <input type="text" name="partner_webhook_secret" placeholder="{{ '•••• postavljen' if pconfig.get('webhook_secret_encrypted') else '' }}">
+    </div>
+    <div>
+      <label><input type="checkbox" name="catalog_sync" {{ 'checked' if pconfig.get('catalog_sync') }} style="width:auto"> Sinhronizuj usluge iz partnera (GET /services)</label>
+      <label><input type="checkbox" name="email_to_owner" {{ 'checked' if pconfig.get('email_to_owner') }} style="width:auto"> Šalji i email vlasniku (uz push u partnera)</label>
+      <label><input type="checkbox" name="polling_fallback" {{ 'checked' if pconfig.get('polling_fallback') }} style="width:auto"> Polling fallback (partner nema webhook)</label>
+      {% if t %}
+      <label>Webhook URL za partnera</label>
+      <code style="display:block;padding:8px">{{ base_url }}/webhooks/partner/{{ t.id }}</code>
+      {% endif %}
+    </div>
+  </div>
+</div>
+
+<div class="card">
+  <h2>Broj / SIM</h2>
+  <label>Dodijeljeni broj</label>
+  <select name="phone_number_id">
+    <option value="">— bez broja —</option>
+    {% for n in numbers %}
+    <option value="{{ n.id }}" {{ 'selected' if n.tenant_id == (t.id if t) }}>
+      {{ n.msisdn }} (port {{ n.gateway_port if n.gateway_port is not none else '?' }}, {{ n.operator or '?' }})
+      {%- if n.tenant_id and (not t or n.tenant_id != t.id) %} — ZAUZET{% endif %}
+    </option>
+    {% endfor %}
+  </select>
+  <p class="muted">Nove brojeve dodajete pod <a href="/admin/numbers">Brojevi/SIM</a>.</p>
+</div>
+
+<div class="card">
+  <h2>Prompt override <small style="font-weight:400">(samo za neobične salone — inače prazno)</small></h2>
+  <textarea name="prompt_override" style="min-height:120px;font-family:monospace"
+    placeholder="Prazno = koristi globalni šablon">{{ override_body }}</textarea>
+</div>
+
+<button>Sačuvaj</button>
+</form>
+
+{% if t and t.scheduling_provider == 'partner_api' %}
+<div class="card" style="margin-top:20px">
+  <h2>Test veze s partnerom (§8.3)</h2>
+  <p class="muted">Pokreće živi <code>GET /availability</code> i dry-run
+  <code>POST /booking-requests</code>, prikazuje sirove odgovore.</p>
+  <form method="post" action="/admin/tenants/{{ t.id }}/test-connection">
+    <button class="ghost">Pokreni test</button>
+  </form>
+  {% if test_result %}<pre>{{ test_result }}</pre>{% endif %}
+</div>
+{% endif %}
+{% endblock %}

gogo/templates/admin/tenants.html

@@ -0,0 +1,27 @@
+{% extends "base.html" %}
+{% block title %}Saloni — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<h1>Saloni <a class="btn small" style="margin-left:12px" href="/admin/tenants/new">+ Novi salon</a></h1>
+<div class="card">
+<table>
+  <tr><th>Salon</th><th>Provajder</th><th>Broj</th><th>Plaćeno do</th><th>Minute (mj)</th><th>Status</th><th></th></tr>
+  {% for row in rows %}
+  <tr>
+    <td><b>{{ row.tenant.name }}</b><br><span class="muted">{{ row.tenant.city }} · {{ row.tenant.slug }}</span></td>
+    <td>{{ row.tenant.scheduling_provider }}</td>
+    <td>{{ row.msisdn or '—' }}</td>
+    <td>{{ row.tenant.paid_until.strftime('%d.%m.%Y.') if row.tenant.paid_until else '—' }}</td>
+    <td>{{ row.used_minutes }}/{{ row.tenant.included_minutes }}</td>
+    <td><span class="badge {{ 'confirmed' if row.tenant.status=='active' else 'rejected' }}">{{ row.tenant.status }}</span></td>
+    <td style="white-space:nowrap">
+      <a class="btn small ghost" href="/admin/tenants/{{ row.tenant.id }}">Uredi</a>
+      <form method="post" action="/admin/impersonate/{{ row.tenant.id }}" style="display:inline">
+        <button class="small">Otvori kao salon</button>
+      </form>
+    </td>
+  </tr>
+  {% endfor %}
+</table>
+</div>
+{% endblock %}

gogo/templates/admin/usage.html

@@ -0,0 +1,26 @@
+{% extends "base.html" %}
+{% block title %}Potrošnja — Gogo Admin{% endblock %}
+{% block nav %}{% include "admin/_nav.html" %}{% endblock %}
+{% block content %}
+<h1>Potrošnja po salonima — {{ month }}</h1>
+<div class="card">
+<table>
+  <tr><th>Salon</th><th>Minute asistenta</th><th>Pozivi</th><th>SMS</th><th>Chat</th>
+      <th>Zahtjevi (mj)</th><th>Procj. trošak (LLM+TTS)</th></tr>
+  {% for r in rows %}
+  <tr>
+    <td><b>{{ r.tenant.name }}</b></td>
+    <td>{{ r.used_minutes }}/{{ r.tenant.included_minutes }}
+      {% if r.over_100 %}<span class="badge rejected">100%+</span>
+      {% elif r.over_80 %}<span class="badge pending">80%+</span>{% endif %}</td>
+    <td>{{ r.calls }}</td>
+    <td>{{ r.sms }}</td>
+    <td>{{ r.chats }}</td>
+    <td>{{ r.requests }}</td>
+    <td>~{{ r.est_cost_km }} KM</td>
+  </tr>
+  {% endfor %}
+</table>
+<p class="muted">Procjena troška: {{ cost_note }}</p>
+</div>
+{% endblock %}