Add control logic engine, panel logic dialogs, logic-edit restriction

Introduce server-side control-logic flow graphs (cron/alarm triggers,
Lua blocks) with CRUD endpoints, panel-logic lifecycle triggers and
user-interaction dialog nodes, and a synthetic node-graph editor.

Add an optional logic-editor allowlist (server.logic_editors) gating who
may add/edit panel logic and control logic, surfaced via /api/v1/me and
enforced in the API; hide logic affordances in the UI accordingly.

Update README, example config, and functional/technical specs to cover
all current features (plot panels, panel/control logic, local variables,
access control) and refresh the in-app manual and contextual help.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/config/config.go

@@ -50,6 +50,13 @@ type ServerConfig struct {
 	// Blacklist downgrades specific users' global access level. Everyone not
 	// listed is trusted with full write access.
 	Blacklist []BlacklistEntry `toml:"blacklist"`
+
+	// LogicEditors optionally restricts who may add or edit panel logic (the
+	// <logic> block of interfaces) and server-side control logic. Entries are
+	// usernames or group names. When empty, no restriction applies (any user
+	// with write access may edit logic). Anonymous/trusted-LAN callers are
+	// always permitted.
+	LogicEditors []string `toml:"logic_editors"`
 }
 
 type DatasourceConfig struct {
@@ -131,6 +138,9 @@ func applyEnv(cfg *Config) {
 	if v := env("UOPI_SERVER_DEFAULT_USER"); v != "" {
 		cfg.Server.DefaultUser = v
 	}
+	if v := env("UOPI_SERVER_LOGIC_EDITORS"); v != "" {
+		cfg.Server.LogicEditors = strings.Fields(v)
+	}
 	if v := env("UOPI_EPICS_CA_ADDR_LIST"); v != "" {
 		cfg.Datasource.EPICS.CAAddrList = v
 	}