Initial implementation of inventree

A small IT asset inventory system built around a nested folder tree,
matching the project brief: Go + html/template + Bootstrap 5 + vanilla JS,
SQLite storage (WAL, FKs, migrations), embedded templates/static assets,
single compiled binary.

- AJAX-driven inventory tree: lazy-loaded folder expansion with per-user
  persisted expand state, drag-and-drop move for folders/assets, safe
  delete-with-relocate-or-cascade confirmation, search with breadcrumbs.
- Assets: CRUD, duplicate, move, auto-generated IT-000001-style IDs,
  CSV import (with optional folder auto-create) and export.
- Admin-defined item types with custom fields (text/long_text/number/date/
  boolean/dropdown/url/ip_address).
- Configurable statuses, session-based auth (bcrypt, secure cookies),
  admin/user roles, user management.
- CLI: serve, version, database migrate, database backup; /healthz;
  graceful shutdown; Dockerfile/docker-compose/systemd unit; Go test suite.

internal/web/router.go

@@ -0,0 +1,104 @@
+package web
+
+import (
+	"net/http"
+
+	content "inventree/web"
+)
+
+// Router builds the complete HTTP handler for inventree: static assets,
+// authentication, the AJAX-driven inventory tree, and the traditional
+// full-page admin sections (item types, users, settings).
+func (a *App) Router() http.Handler {
+	mux := http.NewServeMux()
+
+	// Static assets (Bootstrap, icons, vanilla JS) and health check are
+	// always public.
+	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServerFS(mustSub(content.StaticFS, "static"))))
+	mux.HandleFunc("GET /healthz", a.handleHealthz)
+
+	// Auth
+	mux.HandleFunc("GET /login", a.handleLoginForm)
+	mux.HandleFunc("POST /login", a.handleLoginSubmit)
+	mux.HandleFunc("POST /logout", a.handleLogout)
+
+	mux.HandleFunc("GET /{$}", a.requireLogin(a.handleRoot))
+
+	// Inventory tree (AJAX fragments)
+	mux.HandleFunc("GET /inventory", a.requireLogin(a.handleInventoryPage))
+	mux.HandleFunc("GET /app/tree/children", a.requireLogin(a.handleTreeChildren))
+	mux.HandleFunc("POST /app/tree/collapse", a.requireLogin(a.handleTreeCollapse))
+	mux.HandleFunc("POST /app/tree/collapse-all", a.requireLogin(a.handleTreeCollapseAll))
+
+	mux.HandleFunc("GET /app/panel/root", a.requireLogin(a.handlePanelRoot))
+	mux.HandleFunc("GET /app/panel/folders/{id}", a.requireLogin(a.handlePanelFolder))
+	mux.HandleFunc("GET /app/panel/assets/{id}", a.requireLogin(a.handlePanelAsset))
+	mux.HandleFunc("GET /app/panel/assets/new", a.requireAdmin(a.handlePanelAssetNew))
+	mux.HandleFunc("GET /app/panel/assets/{id}/edit", a.requireAdmin(a.handlePanelAssetEdit))
+	mux.HandleFunc("GET /app/forms/asset-fields", a.requireLogin(a.handleAssetFieldsFragment))
+
+	mux.HandleFunc("GET /app/search", a.requireLogin(a.handleSearch))
+
+	// Folder mutations (JSON in/out)
+	mux.HandleFunc("GET /app/folders/{id}", a.requireAdmin(a.handleFolderGet))
+	mux.HandleFunc("POST /app/folders", a.requireAdmin(a.handleFolderCreate))
+	mux.HandleFunc("PATCH /app/folders/{id}", a.requireAdmin(a.handleFolderUpdate))
+	mux.HandleFunc("POST /app/folders/{id}/move", a.requireAdmin(a.handleFolderMove))
+	mux.HandleFunc("GET /app/folders/{id}/delete-info", a.requireAdmin(a.handleFolderDeleteInfo))
+	mux.HandleFunc("DELETE /app/folders/{id}", a.requireAdmin(a.handleFolderDelete))
+
+	// Asset mutations (JSON in/out)
+	mux.HandleFunc("POST /app/assets", a.requireAdmin(a.handleAssetCreate))
+	mux.HandleFunc("PATCH /app/assets/{id}", a.requireAdmin(a.handleAssetUpdate))
+	mux.HandleFunc("DELETE /app/assets/{id}", a.requireAdmin(a.handleAssetDelete))
+	mux.HandleFunc("POST /app/assets/{id}/duplicate", a.requireAdmin(a.handleAssetDuplicate))
+	mux.HandleFunc("POST /app/assets/{id}/move", a.requireAdmin(a.handleAssetMove))
+
+	// CSV import/export
+	mux.HandleFunc("GET /export/assets.csv", a.requireLogin(a.handleExportCSV))
+	mux.HandleFunc("POST /import/assets.csv", a.requireAdmin(a.handleImportCSV))
+
+	// Item types (admin, traditional pages)
+	mux.HandleFunc("GET /item-types", a.requireAdmin(a.handleItemTypesList))
+	mux.HandleFunc("GET /item-types/new", a.requireAdmin(a.handleItemTypeNewForm))
+	mux.HandleFunc("POST /item-types", a.requireAdmin(a.handleItemTypeCreate))
+	mux.HandleFunc("GET /item-types/{id}/edit", a.requireAdmin(a.handleItemTypeEditForm))
+	mux.HandleFunc("POST /item-types/{id}", a.requireAdmin(a.handleItemTypeUpdate))
+	mux.HandleFunc("POST /item-types/{id}/delete", a.requireAdmin(a.handleItemTypeDelete))
+	mux.HandleFunc("POST /item-types/{id}/fields", a.requireAdmin(a.handleFieldCreate))
+	mux.HandleFunc("POST /item-types/{id}/fields/{fieldID}", a.requireAdmin(a.handleFieldUpdate))
+	mux.HandleFunc("POST /item-types/{id}/fields/{fieldID}/delete", a.requireAdmin(a.handleFieldDelete))
+
+	// Users (admin, traditional pages)
+	mux.HandleFunc("GET /users", a.requireAdmin(a.handleUsersList))
+	mux.HandleFunc("GET /users/new", a.requireAdmin(a.handleUserNewForm))
+	mux.HandleFunc("POST /users", a.requireAdmin(a.handleUserCreate))
+	mux.HandleFunc("GET /users/{id}/edit", a.requireAdmin(a.handleUserEditForm))
+	mux.HandleFunc("POST /users/{id}", a.requireAdmin(a.handleUserUpdate))
+	mux.HandleFunc("POST /users/{id}/password", a.requireAdmin(a.handleUserPassword))
+	mux.HandleFunc("POST /users/{id}/delete", a.requireAdmin(a.handleUserDelete))
+
+	// Settings (admin, traditional page)
+	mux.HandleFunc("GET /settings", a.requireAdmin(a.handleSettingsPage))
+	mux.HandleFunc("POST /settings/general", a.requireAdmin(a.handleSettingsGeneral))
+	mux.HandleFunc("POST /settings/statuses", a.requireAdmin(a.handleStatusCreate))
+	mux.HandleFunc("POST /settings/statuses/{id}", a.requireAdmin(a.handleStatusUpdate))
+	mux.HandleFunc("POST /settings/statuses/{id}/delete", a.requireAdmin(a.handleStatusDelete))
+	mux.HandleFunc("POST /settings/statuses/{id}/reorder", a.requireAdmin(a.handleStatusReorder))
+
+	return a.loadSession(mux)
+}
+
+func (a *App) handleHealthz(w http.ResponseWriter, r *http.Request) {
+	if err := a.DB.PingContext(r.Context()); err != nil {
+		writeErr(w, http.StatusServiceUnavailable, "database unavailable")
+		return
+	}
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte("ok"))
+}
+
+func (a *App) handleRoot(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, "/inventory", http.StatusSeeOther)
+}