Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -67,10 +67,30 @@ Configuration is done via environment variables. See `docker-compose.yml` for de
 | `SECRET_KEY` | (required) | Session signing key |
 | `OLLAMA_BASE_URL` | `http://ollama:11434` | Ollama API endpoint |
 | `DEFAULT_MODEL` | `llama3.1` | Default LLM model to auto-pull on startup |
+| `SECURE_COOKIES` | `false` | Set to `true` when behind TLS to add `Secure` flag to session cookies |
 | `LOG_LEVEL` | `INFO` | Logging level |
 
 For production deployments, `docker-compose.prod.yml` supports Docker secrets (`SECRET_KEY_FILE`, `DATABASE_URL_FILE`) and includes network isolation, health checks, and resource limits.
 
+## Production Deployment
+
+### Reverse Proxy (Required)
+
+Fabled Assistant does **not** handle SSL/TLS. You must run it behind a reverse proxy for production use:
+
+- **Nginx**, **Traefik**, or **Caddy** in front of the app container
+- Terminate TLS at the proxy and forward traffic to port 5000
+- **Do not expose port 5000 directly to the internet**
+- **Rate-limit auth endpoints** at the proxy layer — recommended: limit `/api/auth/login` and `/api/auth/register` to ~5 requests/minute per IP to prevent brute-force attacks
+- **Set Content Security Policy headers** at the proxy — recommended: `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'`
+
+### Security Checklist
+
+- **Set a strong `SECRET_KEY`** — used to sign session cookies. Generate one with `python -c "import secrets; print(secrets.token_hex(32))"` or use Docker secrets via `SECRET_KEY_FILE`.
+- **Registration auto-closes** — After the first user registers (who becomes admin), registration is closed by default. The admin can re-enable it from the user management page (`/admin/users`).
+- **Use Docker secrets in production** — `docker-compose.prod.yml` reads `SECRET_KEY_FILE` and `DATABASE_URL_FILE` instead of plain environment variables.
+- **Keep Ollama on an internal network** — The default compose files keep Ollama on a Docker-internal network, not exposed to the host.
+
 ## Technical Overview
 
 ### Stack