Replace the single env/generated password with a proper account system,
owned entirely by the webui plugin:
- auth_store: SQLite users table, PBKDF2-HMAC-SHA256 password hashing
(per-user salt, 210k iterations) via OpenSSL. DB at NAUT_WEBUI_DB or
an XDG default. Thread-safe (serialized connection).
- Login verifies against the DB; sessions now carry the username + role.
First run bootstraps an admin from NAUT_AUTH_USER/PASSWORD or a
generated password (logged once).
- Admin-only user management: GET/POST /api/users, /api/users/delete,
/api/users/password, /api/users/role. Self-service POST
/api/account/password. Guards the last admin and invalidates a user's
sessions on delete or password reset.
- /api/auth/status and /api/login now return the role.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
a4ec585aed