Feature 1: Local accounts, replacing shared token

- Local accounts with bcrypt password hashing; first-run setup via POST /api/setup
- Personal API tokens (dmv_<48hex>, SHA-256 hashed at rest) for scripted access
- Server-side in-memory sessions with 32-byte secure cookie (dockmv_session, 7-day TTL, sliding renewal)
- Login rate limiting (exponential backoff 1s–30s cap) per IP
- Refuse to bind non-loopback while no account exists, unless DOCKMV_TRUST_ADDR=1 (for Docker's port mapping)
- Every account can manage every other account (no roles in v1)
- Auth middleware: public-path allowlist (/api/setup, /api/login, /api/logout, /api/me, /api/health) + session cookie check + API token (X-Auth-Token or Authorization: Bearer) check
- Frontend AuthGate gates app on GET /api/me; shows setup screen or login form or app tree as needed
- Account tab for personal token management; sign-out button in topbar
- Break: removed --token flag, DOCKMV_TOKEN env var, ?token= query param, /api/health no longer auto-responds when unauthenticated

Verified: go build/vet clean, frontend tsc+vite clean. Sandbox cannot execute binaries to test setup→login→session→token flow at runtime; recommend manual pass before merge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -31,17 +31,17 @@ reach it — see [sources](#sources).
 ```bash
 git clone https://git.azuze.fr/kawa/DockMV.git dockmv && cd dockmv
 docker compose up -d
-docker compose logs dockmv      # prints the URL, including the access token
+docker compose logs dockmv      # prints the URL
 ```
 
-Open the printed URL. It binds to `127.0.0.1` only; reach it from your laptop with a tunnel:
+Open the printed URL, create the first account (there is no default login), and you're in. It binds to
+`127.0.0.1` only; reach it from your laptop with a tunnel:
 
 ```bash
 ssh -L 8080:127.0.0.1:8080 you@source-host
 ```
 
-Uses the published image `git.azuze.fr/kawa/dockmv:latest`. Pin a version with `VERSION=v1.2.0 docker compose up -d`,
-and set a fixed token with `DOCKMV_TOKEN` in the compose file to keep the same URL across restarts.
+Uses the published image `git.azuze.fr/kawa/dockmv:latest`. Pin a version with `VERSION=v1.2.0 docker compose up -d`.
 
 ### Prebuilt binary
 
@@ -190,7 +190,12 @@ carries only genuine run-time overrides and keeps working when the image is upda
 The tool can stop containers and read every volume on the host, so it is treated as a privileged
 admin tool:
 
-- Binds to **`127.0.0.1` by default**. Binding elsewhere auto-generates an access token and prints it.
+- Binds to **`127.0.0.1` by default**. A fresh install has no account yet, and refuses to bind
+  anywhere else until one is created — finish setup over an SSH tunnel first (see above).
+- **Local accounts, no roles yet.** The first visit creates an account; there is no default login.
+  Every account can manage every other account and every resource — the same single-workspace model
+  the rest of the tool already has. Scripted access uses a **personal API token** (Account tab),
+  sent as `X-Auth-Token`, instead of the old shared `--token`.
 - **SSH host keys are verified** like OpenSSH, for sources as well as targets. An unknown key is
   refused until you approve the fingerprint in the UI; a *changed* key is refused outright. Trusted
   keys go to `<data-dir>/known_hosts`.
@@ -255,23 +260,38 @@ dockmv version
 
 ```
 --addr string          address to listen on (default "127.0.0.1:8080")
---token string         require this token on every request; "auto" generates one
---data-dir string      sources, connections and trusted host keys (default: OS config dir)
+--data-dir string      accounts, sources, connections and trusted host keys (default: OS config dir)
 --package-dir string   where migration packages are written (default <data-dir>/packages)
 --docker-host string   local source docker daemon (default: the DOCKER_HOST environment);
                        given explicitly, it overrides the remembered source
 -v                     verbose logging
 ```
 
+Binding to anything but a loopback address refuses to start until an account exists — see the Safety
+section above. Set `DOCKMV_TRUST_ADDR=1` to skip that check when something else already restricts
+exposure, e.g. a container's own port mapping (the shipped `docker-compose.yml` does this).
+
 `inspect` is handy for scripting and for reporting bugs:
 
 ```bash
 dockmv inspect --sizes | jq '.containers[] | {name, image, mounts}'
 ```
 
-Everything the UI does is available over HTTP. Pass the token as `X-Auth-Token` when one is set.
+Everything the UI does is available over HTTP. The browser uses a session cookie, set by
+`/api/login`; scripts use a personal API token from the Account tab, passed as `X-Auth-Token` or
+`Authorization: Bearer …`.
 
 ```
+POST   /api/setup                            create the first account (only while none exists)
+POST   /api/login
+POST   /api/logout
+GET    /api/me                               who's signed in, or whether setup is still needed
+GET    /api/users                            every account
+POST   /api/users                            create another account
+DELETE /api/users/{id}
+GET    /api/tokens                           the caller's own personal API tokens
+POST   /api/tokens                           create one; the plaintext is only ever shown once
+DELETE /api/tokens/{id}
 GET    /api/health
 GET    /api/source                          inventory + default selections
 GET    /api/source/sizes                    volume sizes (slow)