feat(client): add admin GUI for stations CRUD and recipe assignments

Adds a complete browser-based interface for managing stations,
closing the last deliverable of rev04 Phase 1.

- New /admin/stations page with stations table, create/edit modal,
  delete confirmation and dedicated recipe-assignment modal
- Proxy endpoints under /admin/api/stations/* covering CRUD and
  recipe assign/unassign so all admin operations stay behind the
  Flask CSRF + admin_required guard
- Navbar entry "Stazioni" (desktop + mobile), visible to admins only
- 10 new tests covering page render, every proxy and the non-admin
  redirect

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

client/blueprints/admin.py

@@ -43,6 +43,31 @@ def user_list():
     return render_template("admin/users.html", users=users)
 
 
+@admin_bp.route("/stations")
+@login_required
+@admin_required
+def station_list():
+    """Station management page."""
+    resp = api_client.get("/api/stations")
+    if isinstance(resp, dict) and resp.get("error"):
+        flash(_("Errore nel caricamento delle stazioni: %(error)s", error=resp.get("detail", "")), "error")
+        stations = []
+    elif isinstance(resp, list):
+        stations = resp
+    else:
+        stations = []
+
+    recipes_resp = api_client.get("/api/recipes")
+    if isinstance(recipes_resp, list):
+        all_recipes = recipes_resp
+    elif isinstance(recipes_resp, dict) and isinstance(recipes_resp.get("items"), list):
+        all_recipes = recipes_resp["items"]
+    else:
+        all_recipes = []
+
+    return render_template("admin/stations.html", stations=stations, all_recipes=all_recipes)
+
+
 # ============================================================================
 # API PROXY AJAX (JSON)
 # ============================================================================
@@ -102,3 +127,74 @@ def api_toggle_active(user_id: int):
         return jsonify(resp), resp.get("status_code", 500)
 
     return jsonify(resp), 200
+
+
+# --- Stations ---
+
+@admin_bp.route("/api/stations", methods=["POST"])
+@login_required
+@admin_required
+def api_create_station():
+    """Proxy: Create a new station."""
+    data = request.get_json(silent=True) or {}
+    resp = api_client.post("/api/stations", data=data)
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 201
+
+
+@admin_bp.route("/api/stations/<int:station_id>", methods=["PUT"])
+@login_required
+@admin_required
+def api_update_station(station_id: int):
+    """Proxy: Update a station."""
+    data = request.get_json(silent=True) or {}
+    resp = api_client.put(f"/api/stations/{station_id}", data=data)
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+@admin_bp.route("/api/stations/<int:station_id>", methods=["DELETE"])
+@login_required
+@admin_required
+def api_delete_station(station_id: int):
+    """Proxy: Delete a station."""
+    resp = api_client.delete(f"/api/stations/{station_id}")
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify({"deleted": True}), 200
+
+
+@admin_bp.route("/api/stations/<int:station_id>/recipes", methods=["GET"])
+@login_required
+@admin_required
+def api_list_station_recipes(station_id: int):
+    """Proxy: List recipes assigned to a station."""
+    resp = api_client.get(f"/api/stations/{station_id}/recipes")
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 200
+
+
+@admin_bp.route("/api/stations/<int:station_id>/recipes", methods=["POST"])
+@login_required
+@admin_required
+def api_assign_recipe(station_id: int):
+    """Proxy: Assign a recipe to a station."""
+    data = request.get_json(silent=True) or {}
+    resp = api_client.post(f"/api/stations/{station_id}/recipes", data=data)
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify(resp), 201
+
+
+@admin_bp.route("/api/stations/<int:station_id>/recipes/<int:recipe_id>", methods=["DELETE"])
+@login_required
+@admin_required
+def api_unassign_recipe(station_id: int, recipe_id: int):
+    """Proxy: Remove a recipe assignment from a station."""
+    resp = api_client.delete(f"/api/stations/{station_id}/recipes/{recipe_id}")
+    if isinstance(resp, dict) and resp.get("error"):
+        return jsonify(resp), resp.get("status_code", 500)
+    return jsonify({"deleted": True}), 200