Replaces the optional shared-password auth (AUTH_PASSWORD env var,
in-memory sessions) with account-based auth: a users table (scrypt
password hashes via node:crypto — no native dep), SQLite-backed sessions
that survive restarts, a one-time setup screen that creates the first
account, and a Settings → Users card for adding/removing users and
resetting passwords (everyone equal, shared herd — no roles).
Theme and weight-unit become per-user preferences behind the unchanged
/api/settings shape (NULL inherits the global value); rabbitry name, kit
prefix, and default breed stay shared. Failed logins get a flat 350 ms
delay and timing-safe comparison. MYKINDLEBOX_PASSWORD is retired —
upgrading deployments see the setup screen once, data untouched.
Also: configurable host port (MYKINDLEBOX_PORT), compose healthcheck
gating nginx on API readiness, nginx body-size headroom for 10 MB
imports, server .dockerignore hardening, ESLint ignore for vendored
tesseract assets, react-hooks rule fixes, exact tesseract.js pin with SW
cache-upgrade contract and failure-isolated precache, and OCR date
parsing fixes (2-digit-year pivot, impossible-date rejection).
Design doc: memory-bank/FEATURE_User_Accounts.md
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
fireshaper