Publish menus from the browser instead of scp

The admin signs in with the shared password, creates a Menu Set, drops photos
into it (shrunk in the browser first), reorders Pages by dragging or with
up/down buttons, previews the Draft exactly as customers would see it, and
publishes it over the previous set. Restore and delete close the loop. Mutations
need a session, a same-origin request and a CSRF token derived from the session;
a Draft's media is served only to a session holder.

public/styles.css

@@ -236,6 +236,12 @@ a {
   text-decoration: underline;
 }
 
+.notice--admin {
+  max-width: none;
+  border-left-color: var(--accent);
+  background: color-mix(in srgb, var(--accent) 22%, var(--rail));
+}
+
 /* ---------- The Pages ---------- */
 
 .pages {