Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

This commit is contained in:

Bryan Van Deusen

2026-02-12 17:49:22 -05:00

parent f2496916f9

commit f77b029943

16 changed files with 809 additions and 60 deletions

									
										frontend/src/types/auth.ts
									
		+1
		
												View File
												
				@@ -8,4 +8,5 @@ export interface User {

				export interface AuthStatus {

				  has_users: boolean;

				  registration_open: boolean;

				}