Add registration control, admin user management, and security hardening

- Registration auto-closes after first user; admin can toggle from /admin/users
- Admin user management view with user list and delete
- Password confirmation on registration form
- Password change in Settings (PUT /api/auth/password)
- Session cookie hardening: HttpOnly, SameSite=Lax, optional Secure flag
- Startup warning when SECRET_KEY is default
- Production deployment docs: reverse proxy, rate limiting, CSP headers
- Fix assist prompt to preserve markdown headings in target sections
- Simplify prod compose networking

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/fabledassistant/services/assist.py

@@ -20,6 +20,9 @@ def build_assist_messages(
         f"--- Full Document ---\n{truncated_body}\n--- End Document ---\n\n"
         "The user will give you a specific section of the document and an instruction. "
         "Output ONLY the replacement text for that section. "
+        "If the target section starts with a markdown heading (e.g. ## Heading), "
+        "your output MUST also start with a heading at the same level. "
+        "You may revise the heading text but do not remove it. "
         "Do not include other sections, explanatory text, or markdown code fences around the output. "
         "Match the document's existing tone and style."
     )