Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/components/AppHeader.vue

@@ -61,6 +61,7 @@ router.afterEach(() => {
         <router-link to="/tasks" class="nav-link">Tasks</router-link>
         <router-link to="/chat" class="nav-link">Chat</router-link>
         <router-link to="/settings" class="nav-link">Settings</router-link>
+        <router-link v-if="authStore.isAdmin" to="/admin/users" class="nav-link">Users</router-link>
         <span class="status-indicator" :class="statusClass" :title="statusLabel">
           <span class="status-dot"></span>
         </span>