Dashboard Studio 2.0.0: Admin, Builder and Dashboard screens, roles, Haven

- Home Assistant administrators are admins: Dashboard, Builder and Admin screens
- Everyone else only sees the dashboards an admin chose, always in kiosk mode;
  the server enforces it (saving, people, devices, history are admin-only, and
  the websocket only allows reading states and controlling devices)
- Admin screen: dashboards, people and what each sees (with preview), devices,
  messages to the screens, the Haven app, activity, about
- Haven: new Android app (haven/) that only shows dashboards; replaces the
  Dashboard Studio Android app and signs in through Home Assistant's page
- Screens pick up dashboard and access changes within a minute
- Version history records who made each change; panel visible to all users

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

haven/build.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Builds Haven, the Android app, without Gradle, with the Android SDK's own tools, and copies it into the
+# Home Assistant app, which offers it for download (Admin, Haven app; and Install as an app on Android).
+#   ./build.sh          the release build, signed with ~/.android/dashboard-studio.jks (made the first time)
+#   ./build.sh debug    a debuggable build, for testing in the emulator (Chrome can inspect its pages)
+# Keep the key: Android only installs an update that is signed with the same key as the installed app.
+set -e
+cd "$(dirname "$0")"
+SDK="${ANDROID_HOME:-$HOME/Library/Android/sdk}"
+BT="$SDK/build-tools/$(ls "$SDK/build-tools" | sort -V | tail -1)"
+JAR="$SDK/platforms/$(ls "$SDK/platforms" | sort -V | tail -1)/android.jar"
+KEY="${DS_KEYSTORE:-$HOME/.android/dashboard-studio.jks}"
+OUT=build
+rm -rf "$OUT" && mkdir -p "$OUT/res" "$OUT/classes" "$OUT/gen"
+
+DEBUG=""
+[ "$1" = "debug" ] && DEBUG="--debug-mode"
+"$BT/aapt2" compile --dir res -o "$OUT/res"
+"$BT/aapt2" link -o "$OUT/app.unsigned.apk" -I "$JAR" --manifest AndroidManifest.xml -A assets \
+  --java "$OUT/gen" $DEBUG "$OUT"/res/*.flat
+javac -nowarn --release 17 -classpath "$JAR" -d "$OUT/classes" $(find src "$OUT/gen" -name '*.java')
+"$BT/d8" --release --min-api 24 --lib "$JAR" --output "$OUT" $(find "$OUT/classes" -name '*.class')
+(cd "$OUT" && zip -q app.unsigned.apk classes.dex)
+"$BT/zipalign" -f -p 4 "$OUT/app.unsigned.apk" "$OUT/app.aligned.apk"
+
+if [ ! -f "$KEY" ]; then
+  mkdir -p "$(dirname "$KEY")"
+  keytool -genkeypair -keystore "$KEY" -storepass dashboard-studio -keypass dashboard-studio -alias app \
+    -keyalg RSA -keysize 4096 -validity 36500 -dname "CN=Dashboard Studio" >/dev/null
+  echo "Made a new signing key: $KEY (keep it, updates need the same key)"
+fi
+"$BT/apksigner" sign --ks "$KEY" --ks-pass pass:dashboard-studio --ks-key-alias app --out "$OUT/haven.apk" "$OUT/app.aligned.apk"
+if [ -z "$DEBUG" ]; then
+  cp "$OUT/haven.apk" ../dashboard_studio/web/haven.apk
+  echo "Built and copied to dashboard_studio/web/haven.apk"
+else
+  echo "Built $OUT/haven.apk (debug)"
+fi