Settings: connect this installation to a portal

A superuser-only tab that redeems a claim code and shows the link's state. It
names the account a remote session acts as, because that is the thing being
granted and the person granting it should see it spelled out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XtBzdDyLsmDaF1W7DLYtYM

frontend/src/routes/_layout/settings.tsx

@@ -3,6 +3,7 @@ import { createFileRoute } from "@tanstack/react-router"
 import Appearance from "@/components/UserSettings/Appearance"
 import ChangePassword from "@/components/UserSettings/ChangePassword"
 import DeleteAccount from "@/components/UserSettings/DeleteAccount"
+import RemoteAccess from "@/components/UserSettings/RemoteAccess"
 import UserInformation from "@/components/UserSettings/UserInformation"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
 import useAuth from "@/hooks/useAuth"
@@ -14,6 +15,12 @@ const tabsConfig = [
   { value: "danger-zone", title: "Danger zone", component: DeleteAccount },
 ]
 
+// Whether this whole installation can be reached from outside is not a
+// personal preference, so the tab only exists for an operator.
+const superuserTabs = [
+  { value: "remote-access", title: "Remote access", component: RemoteAccess },
+]
+
 export const Route = createFileRoute("/_layout/settings")({
   component: UserSettings,
   head: () => ({
@@ -29,7 +36,10 @@ function UserSettings() {
   const { user: currentUser } = useAuth()
   // A superuser deleting its own account would lock everyone out.
   const finalTabs = currentUser?.is_superuser
-    ? tabsConfig.filter((tab) => tab.value !== "danger-zone")
+    ? [
+        ...tabsConfig.filter((tab) => tab.value !== "danger-zone"),
+        ...superuserTabs,
+      ]
     : tabsConfig
 
   if (!currentUser) {