Feature 1: Local accounts, replacing shared token

- Local accounts with bcrypt password hashing; first-run setup via POST /api/setup
- Personal API tokens (dmv_<48hex>, SHA-256 hashed at rest) for scripted access
- Server-side in-memory sessions with 32-byte secure cookie (dockmv_session, 7-day TTL, sliding renewal)
- Login rate limiting (exponential backoff 1s–30s cap) per IP
- Refuse to bind non-loopback while no account exists, unless DOCKMV_TRUST_ADDR=1 (for Docker's port mapping)
- Every account can manage every other account (no roles in v1)
- Auth middleware: public-path allowlist (/api/setup, /api/login, /api/logout, /api/me, /api/health) + session cookie check + API token (X-Auth-Token or Authorization: Bearer) check
- Frontend AuthGate gates app on GET /api/me; shows setup screen or login form or app tree as needed
- Account tab for personal token management; sign-out button in topbar
- Break: removed --token flag, DOCKMV_TOKEN env var, ?token= query param, /api/health no longer auto-responds when unauthenticated

Verified: go build/vet clean, frontend tsc+vite clean. Sandbox cannot execute binaries to test setup→login→session→token flow at runtime; recommend manual pass before merge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,11 +1,12 @@
 # dockmv, running on the SOURCE host.
 #
 #   docker compose up -d
-#   docker compose logs dockmv   # the URL and access token are printed here
+#   docker compose logs dockmv   # the URL is printed here
 #
 # The container needs the Docker socket to read containers and stream their
 # data. That is equivalent to root on this host, so the UI is protected by a
-# generated token and should not be published to an untrusted network.
+# login (created on first visit) and should not be published to an untrusted
+# network.
 
 services:
   dockmv:
@@ -18,12 +19,15 @@ services:
       - "127.0.0.1:8080:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      # Connections, trusted SSH host keys and built packages.
+      # Accounts, connections, trusted SSH host keys and built packages.
       - migrate-data:/data
     environment:
-      # Set a fixed token to keep the same URL across restarts.
-      # DOCKMV_TOKEN: change-me
       TZ: ${TZ:-UTC}
+      # dockmv listens on 0.0.0.0 *inside* the container so the ports: mapping
+      # above can reach it; that mapping (127.0.0.1 on the host side) is the
+      # actual loopback restriction, not this bind address. This tells dockmv
+      # not to second-guess that and refuse to start before setup is done.
+      DOCKMV_TRUST_ADDR: "1"
     command:
       - serve
       - --addr=0.0.0.0:8080