feat: host lock api so a plugin can load hosts from a config file (#1581)

src/backend/database/routes/host.ts

@@ -85,6 +85,11 @@ import {
   type PlannedProtocolAuth,
 } from "../../hosts/protocol-auth/protocol-auth.js";
 import { findHostProtocol } from "../../hosts/protocol-auth/registry.js";
+import {
+  manualCreateBlockedBy,
+  requireManualCreate,
+  requireUnlockedHost,
+} from "../../hosts/locks.js";
 import {
   mergeStoredSshOptions,
   parseTerminalConfig,
@@ -157,6 +162,7 @@ router.post(
   authenticateJWT,
   permissionManager.requirePermission("hosts.create"),
   requireDataAccess,
+  requireManualCreate,
   requireHostEnrollmentAccessForPath,
   upload.single("key"),
   async (req: Request, res: Response) => {
@@ -736,6 +742,7 @@ router.put(
   authenticateJWT,
   permissionManager.requirePermission("hosts.edit"),
   requireDataAccess,
+  requireUnlockedHost,
   upload.single("key"),
   async (req: Request, res: Response) => {
     const hostId = Array.isArray(req.params.id)
@@ -1205,6 +1212,27 @@ router.put(
   },
 );
 
+/**
+ * @openapi
+ * /host/policy:
+ *   get:
+ *     summary: Host creation policy
+ *     description: Whether hosts can be added by hand, or a plugin manages them all.
+ *     tags:
+ *       - SSH
+ *     responses:
+ *       200:
+ *         description: "{ manualCreate, blockedBy? } where blockedBy is the managing plugin's name."
+ */
+router.get("/policy", authenticateJWT, (_req: Request, res: Response) => {
+  const blocked = manualCreateBlockedBy();
+  res.json(
+    blocked
+      ? { manualCreate: false, blockedBy: blocked.pluginName }
+      : { manualCreate: true },
+  );
+});
+
 /**
  * @openapi
  * /host/db/host:
@@ -1702,6 +1730,7 @@ router.delete(
   authenticateJWT,
   permissionManager.requirePermission("hosts.delete"),
   requireDataAccess,
+  requireUnlockedHost,
   async (req: Request, res: Response) => {
     const userId = (req as AuthenticatedRequest).userId;
     const hostId = Array.isArray(req.params.id)