Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/views/SettingsView.vue

@@ -3,12 +3,17 @@ import { ref, computed, onMounted } from "vue";
 import { useSettingsStore } from "@/stores/settings";
 import { useAuthStore } from "@/stores/auth";
 import { useToastStore } from "@/stores/toast";
+import { apiPut } from "@/api/client";
 import type { ModelInfo } from "@/types/settings";
 
 const store = useSettingsStore();
 const authStore = useAuthStore();
 const toastStore = useToastStore();
 const assistantName = ref("");
+const currentPassword = ref("");
+const newPassword = ref("");
+const confirmNewPassword = ref("");
+const changingPassword = ref(false);
 const saving = ref(false);
 const saved = ref(false);
 const pullProgress = ref<{ model: string; percent: number } | null>(null);
@@ -190,6 +195,33 @@ onMounted(async () => {
   store.fetchInstalledModels();
 });
 
+async function changePassword() {
+  if (newPassword.value !== confirmNewPassword.value) {
+    toastStore.show("New passwords do not match", "error");
+    return;
+  }
+  changingPassword.value = true;
+  try {
+    await apiPut("/api/auth/password", {
+      current_password: currentPassword.value,
+      new_password: newPassword.value,
+    });
+    toastStore.show("Password changed successfully");
+    currentPassword.value = "";
+    newPassword.value = "";
+    confirmNewPassword.value = "";
+  } catch (e: unknown) {
+    if (e && typeof e === "object" && "body" in e) {
+      const body = (e as { body?: { error?: string } }).body;
+      toastStore.show(body?.error || "Failed to change password", "error");
+    } else {
+      toastStore.show("Failed to change password", "error");
+    }
+  } finally {
+    changingPassword.value = false;
+  }
+}
+
 async function saveAssistant() {
   saving.value = true;
   saved.value = false;
@@ -345,6 +377,54 @@ async function handleRestoreFile(event: Event) {
       </div>
     </section>
 
+    <section class="settings-section">
+      <h2>Change Password</h2>
+      <div class="field">
+        <label for="current-password">Current Password</label>
+        <input
+          id="current-password"
+          v-model="currentPassword"
+          type="password"
+          autocomplete="current-password"
+          class="input"
+        />
+      </div>
+      <div class="field">
+        <label for="new-password">New Password</label>
+        <input
+          id="new-password"
+          v-model="newPassword"
+          type="password"
+          autocomplete="new-password"
+          class="input"
+        />
+        <p class="field-hint">Must be at least 8 characters</p>
+      </div>
+      <div class="field">
+        <label for="confirm-new-password">Confirm New Password</label>
+        <input
+          id="confirm-new-password"
+          v-model="confirmNewPassword"
+          type="password"
+          autocomplete="new-password"
+          class="input"
+          :class="{ 'input-error': confirmNewPassword && newPassword !== confirmNewPassword }"
+        />
+        <p v-if="confirmNewPassword && newPassword !== confirmNewPassword" class="error-hint">
+          Passwords do not match
+        </p>
+      </div>
+      <div class="actions">
+        <button
+          class="btn-save"
+          @click="changePassword"
+          :disabled="changingPassword || !currentPassword || newPassword.length < 8 || newPassword !== confirmNewPassword"
+        >
+          {{ changingPassword ? "Changing..." : "Change Password" }}
+        </button>
+      </div>
+    </section>
+
     <section class="settings-section">
       <h2>Model</h2>
       <p class="section-desc">
@@ -538,6 +618,17 @@ async function handleRestoreFile(event: Event) {
   font-size: 0.9rem;
   font-weight: 600;
 }
+.input-error {
+  border-color: var(--color-danger);
+}
+.input-error:focus {
+  border-color: var(--color-danger);
+}
+.error-hint {
+  margin: 0.35rem 0 0;
+  font-size: 0.8rem;
+  color: var(--color-danger);
+}
 
 /* Model list */
 .model-list {