PC set-up: one line per PC (/setup/<name>.ps1), the admin laptop always let in, and the admin check no longer breaks the script

- the inserted administrator check split the header comment, leaving '} for ... run ONCE' as code: WS and SC
  join.ps1 failed to parse (Windows' parser: Missing opening '(' after keyword 'for'); now after the whole line
- site.admin_ips / admin_keys (laptop 10.6.7.38, fixed in UniFi) go into every PC script's firewall rule and key
  files, and into the Mac join line, so running a set-up again never shuts the laptop out
- scripts verified by Windows' own PowerShell parser on the NA Lighting PC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

settings/campus.py

@@ -555,6 +555,7 @@ if [ "$(id -u)" = 0 ]; then
 fi
 mkdir -p "$H/.ssh" && touch "$H/.ssh/authorized_keys" && chmod 700 "$H/.ssh" && chmod 600 "$H/.ssh/authorized_keys"
 grep -qF "$KEY" "$H/.ssh/authorized_keys" || echo "$KEY" >> "$H/.ssh/authorized_keys"
+for A in %(admin)s; do grep -qF "$A" "$H/.ssh/authorized_keys" || echo "$A" >> "$H/.ssh/authorized_keys"; done
 [ "$(id -u)" = 0 ] && chown -R "$U:staff" "$H/.ssh"
 [ "$(id -u)" = 0 ] && { /usr/sbin/systemsetup -setremotelogin on >/dev/null 2>&1 || /bin/launchctl load -w /System/Library/LaunchDaemons/ssh.plist >/dev/null 2>&1; }
 if ! /usr/bin/nc -z -G 2 127.0.0.1 22 >/dev/null 2>&1; then
@@ -574,7 +575,8 @@ else
   echo "Could not reach %(ingest)s at %(base)s - is this Mac on the wired network?"
   exit 1
 fi
-""" % {"ingest": ingest, "key": shq(key), "hello": shq(base + "/api/hello"), "base": base}
+""" % {"ingest": ingest, "key": shq(key), "hello": shq(base + "/api/hello"), "base": base,
+       "admin": " ".join(shq(k) for k in scripts.admin_keys(cfg))}
 
 
 def join_windows(cfg, base):
@@ -591,10 +593,7 @@ def join_windows(cfg, base):
         raise RuntimeError("the Windows template changed: cannot put the program finder in")
     text = text.replace("# Status panel remote access", "# Run in PowerShell as administrator:  irm %s/join.ps1 | iex\n# Status panel remote access" % base, 1)
     # Not elevated: say how, before anything runs (SC's Lighting PC got a DISM error instead, 2026-10-21).
-    text = text.replace("# Status panel remote access", """# Status panel remote access
-if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
-    throw 'Run this as administrator: close this window, right-click Windows PowerShell > Run as administrator, then paste the line again. Nothing was changed.'
-}""", 1)
+    text = scripts.with_admin_check(text)
     text += """
 # 5. Tell %(ingest)s this PC is here: it sets it up within a minute.
 $hello = @{ user = $env:USERNAME; name = $env:COMPUTERNAME; os = 'windows'