Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/fabledassistant/app.py

@@ -26,6 +26,15 @@ def create_app() -> Quart:
 
     app = Quart(__name__, static_folder=None)
     app.secret_key = Config.SECRET_KEY
+    app.config["SESSION_COOKIE_HTTPONLY"] = True
+    app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
+    app.config["SESSION_COOKIE_SECURE"] = Config.SECURE_COOKIES
+
+    if Config.SECRET_KEY == "dev-secret-change-me":
+        logger.warning(
+            "SECRET_KEY is set to the default value — session cookies are insecure. "
+            "Set SECRET_KEY or SECRET_KEY_FILE for production use."
+        )
 
     app.register_blueprint(admin_bp)
     app.register_blueprint(api)