PC set-up: one line per PC (/setup/<name>.ps1), the admin laptop always let in, and the admin check no longer breaks the script

- the inserted administrator check split the header comment, leaving '} for ... run ONCE' as code: WS and SC
  join.ps1 failed to parse (Windows' parser: Missing opening '(' after keyword 'for'); now after the whole line
- site.admin_ips / admin_keys (laptop 10.6.7.38, fixed in UniFi) go into every PC script's firewall rule and key
  files, and into the Mac join line, so running a set-up again never shuts the laptop out
- scripts verified by Windows' own PowerShell parser on the NA Lighting PC

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

settings/scripts.py

@@ -44,15 +44,43 @@ def ps_quote(value, what):
     return "'" + value + "'"
 
 
+def admin_keys(cfg):
+    """The admin laptop's SSH keys (site.admin_keys), checked: one line each, no quotes."""
+    out = []
+    for k in (cfg.get("site") or {}).get("admin_keys") or []:
+        k = str(k).strip()
+        if not re.fullmatch(r"ssh-(ed25519|rsa) [A-Za-z0-9+/=]+( [A-Za-z0-9@._-]+)?", k):
+            raise ValueError("site.admin_keys: %r is not one public SSH key line" % k[:40])
+        out.append(k)
+    return out
+
+
 def site_values(cfg):
     site = cfg.get("site") or {}
     key, mark = public_key(cfg)
+    # The admin laptop (site.admin_ips / admin_keys) gets in everywhere this Mac does, so running a set-up script
+    # again never shuts it out (2026-10-21, the user: "keep SSH on at all times for windows pc, just like the macs").
+    ips = list(dict.fromkeys(list(site.get("ingest_ips") or []) + list(site.get("admin_ips") or [])))
     return {"INGEST_NAME": site.get("ingest_name") or "the Ingest Mac",
-            "INGEST_IPS": ", ".join("'%s'" % ip for ip in site.get("ingest_ips") or []) or "'127.0.0.1'",
+            "INGEST_IPS": ", ".join("'%s'" % ip for ip in ips if re.fullmatch(r"[0-9a-fA-F.:]+", str(ip))) or "'127.0.0.1'",
+            "ADMIN_KEYS": ", ".join("'%s'" % k for k in admin_keys(cfg)),
             "KEY": key or "<< this Mac has no login key yet: run install.sh, then come back >>",
             "KEY_COMMENT": mark or "status-panel", "DVS_HELPER": site.get("dvs_helper") or "/usr/local/sbin/status-panel-dvs-start"}
 
 
+ADMIN_CHECK = """if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this as administrator: close this window, right-click Windows PowerShell > Run as administrator, then paste the line again. Nothing was changed.'
+}"""
+
+
+def with_admin_check(text):
+    """The script stops with plain words unless PowerShell runs as administrator: the check goes after the
+    whole header comment line (inserting it mid-line left "} for ... - run ONCE" as code, 2026-10-21)."""
+    lines = text.split("\n")
+    at = next((i for i, ln in enumerate(lines) if ln.startswith("# Status panel remote access")), 0)
+    return "\n".join(lines[:at + 1] + [ADMIN_CHECK] + lines[at + 1:])
+
+
 def windows_setup(cfg, alias):
     host = cfg["hosts"][alias]
     tasks = [r for r in host.get("runs") or [] if r.get("kind") == "task"]