Add multi-user auth, background generation, and chat UX improvements

Phase 5: Multi-user authentication with session cookies, bcrypt passwords,
first-user-is-admin pattern, per-user data isolation, backup/restore,
Docker Swarm production stack with secrets and network isolation.

Phase 5.1: Chat UX improvements:
- Background generation architecture (GenerationBuffer + asyncio task)
  with SSE fan-out, reconnect support, and periodic DB flushes
- LLM-generated conversation titles (first exchange + every 10th message)
- Stop generation button with cancel_event and partial content preservation
- Relative timestamps in sidebar (5m ago, 3h ago, then dates)
- Empty chat auto-cleanup on navigation away
- Save-as-note uses LLM for title generation, tags notes with "chat"
- Summarize-as-note also tags with "chat"

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/notes.py

@@ -2,6 +2,7 @@ from datetime import date
 
 from quart import Blueprint, jsonify, request
 
+from fabledassistant.auth import login_required, get_current_user_id
 from fabledassistant.services.notes import (
     convert_note_to_task,
     convert_task_to_note,
@@ -21,7 +22,9 @@ notes_bp = Blueprint("notes", __name__, url_prefix="/api/notes")
 
 
 @notes_bp.route("", methods=["GET"])
+@login_required
 async def list_notes_route():
+    uid = get_current_user_id()
     q = request.args.get("q")
     tag = request.args.getlist("tag")
     sort = request.args.get("sort", "updated_at")
@@ -37,13 +40,15 @@ async def list_notes_route():
         is_task = True
 
     notes, total = await list_notes(
-        q=q, tags=tag or None, is_task=is_task, sort=sort, order=order, limit=limit, offset=offset
+        uid, q=q, tags=tag or None, is_task=is_task, sort=sort, order=order, limit=limit, offset=offset
     )
     return jsonify({"notes": [n.to_dict() for n in notes], "total": total})
 
 
 @notes_bp.route("", methods=["POST"])
+@login_required
 async def create_note_route():
+    uid = get_current_user_id()
     data = await request.get_json()
     body = data.get("body", "")
     tags = extract_tags(body)
@@ -56,6 +61,7 @@ async def create_note_route():
         due_date = date.fromisoformat(data["due_date"])
 
     note = await create_note(
+        uid,
         title=data.get("title", ""),
         body=body,
         tags=tags,
@@ -68,43 +74,53 @@ async def create_note_route():
 
 
 @notes_bp.route("/tags", methods=["GET"])
+@login_required
 async def list_tags_route():
+    uid = get_current_user_id()
     q = request.args.get("q")
-    tags = await get_all_tags(q=q)
+    tags = await get_all_tags(uid, q=q)
     return jsonify({"tags": tags})
 
 
 @notes_bp.route("/by-title", methods=["GET"])
+@login_required
 async def get_note_by_title_route():
+    uid = get_current_user_id()
     title = request.args.get("title", "")
     if not title:
         return jsonify({"error": "title parameter is required"}), 400
-    note = await get_note_by_title(title)
+    note = await get_note_by_title(uid, title)
     if note is None:
         return jsonify({"error": "Note not found"}), 404
     return jsonify(note.to_dict())
 
 
 @notes_bp.route("/resolve-title", methods=["POST"])
+@login_required
 async def resolve_title_route():
+    uid = get_current_user_id()
     data = await request.get_json()
     title = data.get("title", "").strip()
     if not title:
         return jsonify({"error": "title is required"}), 400
-    note = await get_or_create_note_by_title(title)
+    note = await get_or_create_note_by_title(uid, title)
     return jsonify(note.to_dict())
 
 
 @notes_bp.route("/<int:note_id>", methods=["GET"])
+@login_required
 async def get_note_route(note_id: int):
-    note = await get_note(note_id)
+    uid = get_current_user_id()
+    note = await get_note(uid, note_id)
     if note is None:
         return jsonify({"error": "Note not found"}), 404
     return jsonify(note.to_dict())
 
 
 @notes_bp.route("/<int:note_id>", methods=["PUT"])
+@login_required
 async def update_note_route(note_id: int):
+    uid = get_current_user_id()
     data = await request.get_json()
     fields = {}
     for key in ("title", "body", "parent_id", "status", "priority"):
@@ -118,39 +134,47 @@ async def update_note_route(note_id: int):
 
     if "body" in fields:
         fields["tags"] = extract_tags(fields["body"])
-    note = await update_note(note_id, **fields)
+    note = await update_note(uid, note_id, **fields)
     if note is None:
         return jsonify({"error": "Note not found"}), 404
     return jsonify(note.to_dict())
 
 
 @notes_bp.route("/<int:note_id>", methods=["DELETE"])
+@login_required
 async def delete_note_route(note_id: int):
-    deleted = await delete_note(note_id)
+    uid = get_current_user_id()
+    deleted = await delete_note(uid, note_id)
     if not deleted:
         return jsonify({"error": "Note not found"}), 404
     return "", 204
 
 
 @notes_bp.route("/<int:note_id>/convert-to-task", methods=["POST"])
+@login_required
 async def convert_note_to_task_route(note_id: int):
+    uid = get_current_user_id()
     try:
-        note = await convert_note_to_task(note_id)
+        note = await convert_note_to_task(uid, note_id)
         return jsonify(note.to_dict()), 200
     except ValueError as e:
         return jsonify({"error": str(e)}), 404
 
 
 @notes_bp.route("/<int:note_id>/convert-to-note", methods=["POST"])
+@login_required
 async def convert_task_to_note_route(note_id: int):
+    uid = get_current_user_id()
     try:
-        note = await convert_task_to_note(note_id)
+        note = await convert_task_to_note(uid, note_id)
         return jsonify(note.to_dict()), 200
     except ValueError as e:
         return jsonify({"error": str(e)}), 404
 
 
 @notes_bp.route("/<int:note_id>/backlinks", methods=["GET"])
+@login_required
 async def get_backlinks_route(note_id: int):
-    links = await get_backlinks(note_id)
+    uid = get_current_user_id()
+    links = await get_backlinks(uid, note_id)
     return jsonify({"backlinks": links})