Remote: reboot / shutdown the Pi from the Output tab

Add POST /api/power/:action (reboot|shutdown) that runs `sudo systemctl
reboot|poweroff` (sudo is passwordless on the appliance), replying before the
host tears down. Two red buttons in the Output tab use a two-tap confirm to
avoid accidental power-offs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -69,6 +69,16 @@ app.post('/api/upload', upload.array('files'), (req, res) => {
 
 app.get('/api/clients', (_req, res) => { res.json([...wss.clients].map((c) => ({ role: c.role, open: c.readyState === 1 }))); });
 
+// ---- Power: reboot / shutdown the appliance (sudo is passwordless on the Pi) -
+app.post('/api/power/:action', (req, res) => {
+  const action = req.params.action;
+  if (action !== 'reboot' && action !== 'shutdown') return res.status(400).json({ ok: false, error: 'azione non valida' });
+  res.json({ ok: true, action });
+  // Reply first, then act — the command tears down this very process/host.
+  // Use systemctl explicitly (the service PATH is minimal); sudo is passwordless.
+  setTimeout(() => { try { execFile('sudo', ['systemctl', action === 'reboot' ? 'reboot' : 'poweroff']); } catch (e) {} }, 700);
+});
+
 app.get('/api/svgs', (_req, res) => {
   let files = [];
   try { files = fs.readdirSync(SVG_DIR).filter(f => /\.svg$/i.test(f)); } catch (e) {}