Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/views/RegisterView.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref } from "vue";
+import { ref, computed, onMounted } from "vue";
 import { useRouter } from "vue-router";
 import { useAuthStore } from "@/stores/auth";
 import AppLogo from "@/components/AppLogo.vue";
@@ -9,11 +9,30 @@ const authStore = useAuthStore();
 
 const username = ref("");
 const password = ref("");
+const confirmPassword = ref("");
 const email = ref("");
 const error = ref("");
 const submitting = ref(false);
+const checking = ref(true);
+
+const passwordMismatch = computed(
+  () => confirmPassword.value.length > 0 && password.value !== confirmPassword.value
+);
+
+const canSubmit = computed(
+  () => !submitting.value && !passwordMismatch.value && password.value.length >= 8
+);
+
+onMounted(async () => {
+  await authStore.checkHasUsers();
+  checking.value = false;
+});
 
 async function handleSubmit() {
+  if (passwordMismatch.value) {
+    error.value = "Passwords do not match";
+    return;
+  }
   error.value = "";
   submitting.value = true;
   try {
@@ -36,50 +55,77 @@ async function handleSubmit() {
   <main class="auth-page">
     <div class="auth-card">
       <div class="auth-brand"><AppLogo :size="32" /><h1>Create Account</h1></div>
-      <form @submit.prevent="handleSubmit">
-        <div class="field">
-          <label for="username">Username</label>
-          <input
-            id="username"
-            v-model="username"
-            type="text"
-            autocomplete="username"
-            required
-            class="input"
-          />
-        </div>
-        <div class="field">
-          <label for="email">Email (optional)</label>
-          <input
-            id="email"
-            v-model="email"
-            type="email"
-            autocomplete="email"
-            class="input"
-          />
-        </div>
-        <div class="field">
-          <label for="password">Password</label>
-          <input
-            id="password"
-            v-model="password"
-            type="password"
-            autocomplete="new-password"
-            required
-            minlength="8"
-            class="input"
-          />
-          <p class="field-hint">Must be at least 8 characters</p>
-        </div>
-        <p v-if="error" class="error-msg">{{ error }}</p>
-        <button type="submit" class="btn-submit" :disabled="submitting">
-          {{ submitting ? "Creating account..." : "Create Account" }}
-        </button>
-      </form>
-      <p class="auth-footer">
-        Already have an account?
-        <router-link to="/login">Sign in</router-link>
-      </p>
+
+      <div v-if="checking" class="loading-msg">Checking registration status...</div>
+
+      <div v-else-if="!authStore.registrationOpen" class="closed-msg">
+        <p>Registration is currently closed.</p>
+        <p>Contact an administrator to get an account.</p>
+        <p class="auth-footer">
+          Already have an account?
+          <router-link to="/login">Sign in</router-link>
+        </p>
+      </div>
+
+      <template v-else>
+        <form @submit.prevent="handleSubmit">
+          <div class="field">
+            <label for="username">Username</label>
+            <input
+              id="username"
+              v-model="username"
+              type="text"
+              autocomplete="username"
+              required
+              class="input"
+            />
+          </div>
+          <div class="field">
+            <label for="email">Email (optional)</label>
+            <input
+              id="email"
+              v-model="email"
+              type="email"
+              autocomplete="email"
+              class="input"
+            />
+          </div>
+          <div class="field">
+            <label for="password">Password</label>
+            <input
+              id="password"
+              v-model="password"
+              type="password"
+              autocomplete="new-password"
+              required
+              minlength="8"
+              class="input"
+            />
+            <p class="field-hint">Must be at least 8 characters</p>
+          </div>
+          <div class="field">
+            <label for="confirm-password">Confirm Password</label>
+            <input
+              id="confirm-password"
+              v-model="confirmPassword"
+              type="password"
+              autocomplete="new-password"
+              required
+              class="input"
+              :class="{ 'input-error': passwordMismatch }"
+            />
+            <p v-if="passwordMismatch" class="error-hint">Passwords do not match</p>
+          </div>
+          <p v-if="error" class="error-msg">{{ error }}</p>
+          <button type="submit" class="btn-submit" :disabled="!canSubmit">
+            {{ submitting ? "Creating account..." : "Create Account" }}
+          </button>
+        </form>
+        <p class="auth-footer">
+          Already have an account?
+          <router-link to="/login">Sign in</router-link>
+        </p>
+      </template>
     </div>
   </main>
 </template>
@@ -111,6 +157,21 @@ async function handleSubmit() {
   margin: 0;
   text-align: center;
 }
+.loading-msg {
+  text-align: center;
+  color: var(--color-text-muted);
+  font-size: 0.9rem;
+  padding: 1rem 0;
+}
+.closed-msg {
+  text-align: center;
+  color: var(--color-text-secondary);
+  font-size: 0.95rem;
+  padding: 0.5rem 0;
+}
+.closed-msg p {
+  margin: 0.5rem 0;
+}
 .field {
   margin-bottom: 1rem;
 }
@@ -134,11 +195,22 @@ async function handleSubmit() {
   outline: none;
   border-color: var(--color-primary);
 }
+.input-error {
+  border-color: var(--color-danger);
+}
+.input-error:focus {
+  border-color: var(--color-danger);
+}
 .field-hint {
   margin: 0.35rem 0 0;
   font-size: 0.8rem;
   color: var(--color-text-muted);
 }
+.error-hint {
+  margin: 0.35rem 0 0;
+  font-size: 0.8rem;
+  color: var(--color-danger);
+}
 .error-msg {
   color: var(--color-danger);
   font-size: 0.9rem;