Public web-only release: SvxPortal front-end + auth backend, install templates and INSTALL.md

Stripped from the internal repo: per-box deploy trees, Go services (nodelist/astmeta/proxy/svxdr),
deploy/sync scripts and all secrets. Config templates for nginx, PHP-FPM, Redis and tmpfiles
live in install/ with CHANGEME placeholders.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

auth/tgadmin.php

@@ -0,0 +1,25 @@
+<?php
+declare(strict_types=1);
+require __DIR__ . '/lib.php';
+start_session();
+$uuid = $_SESSION['uid'] ?? null;
+if (!is_string($uuid) || $uuid === '') { header('Location: /'); exit; }
+$lvl = acct_admin_level($uuid);
+// Admin tool: LVL2+ (admin ranks lvl1/lvl2/lvl3 all collapse to level>=2). Owners
+// who are NOT admins use the separate self-service page (admin_tglist.php).
+if ($lvl < 2) { header('Location: /'); exit; }
+
+$page_title = 'Admin · TG List — SvxPortal';
+require __DIR__ . '/header.php';
+?>
+<div class="container py-4" style="max-width:1000px;">
+  <div id="page-tgadmin">
+    <p class="small text-secondary mb-3">Admin TG manager — add / edit / delete any talkgroup and its full record. <b>Approve</b> assigns an owner callsign so that operator can then self-manage their own TG from the user TG List. This is the admin master; the user page is separate.</p>
+    <div id="tgadminApp"></div>
+    <div id="tgadminMsg" class="small mt-2" style="display:none;"></div>
+  </div>
+</div>
+<?php
+$extra_scripts = '<script>var ADMIN_LEVEL = ' . $lvl . ';</script><script src="/auth/tgadmin.js?v=' . @filemtime(__DIR__ . '/tgadmin.js') . '"></script>';
+require __DIR__ . '/footer.php';
+?>