T

weichen 1d6b8a64a6 Add login page, forced password change, and admin user management

Why: accounts are admin-issued (user decision 2026-09-30, no self
registration); initial and admin-reset passwords must force a change on
first login.

Evidence:
- LoginPage: password (primary) + API key tabs; ChangePasswordGate
  blocks the app until the forced change completes (mismatch/length
  validation inline); App auth state machine checking -> login ->
  mustchange -> ok, session cookie flows through fetch automatically.
- Account menu gains change-password and admin-only user management;
  AdminUsersModal: create account (random initial password generator,
  admin checkbox), reset password, status table (ADMIN/USER, pending
  change chips).
- Fixed a real bug found in the headless walk: menu toggles passed
  e.currentTarget into the setState updater where React nulls it by
  render time, so anchor was null and the menu never rendered; capture
  the element before the updater.
- Headless journey on the real binary with --auth on: admin bootstrap
  via CLI -> first-login forced change -> app; admin creates bob (bob
  sees no user management); alice reset via CLI -> forced change on
  next login; API-key tab login; logout; zero console errors. npm run
  build + vitest green; make test full suite exit 0.

Impact: replaces the old API-key-only LoginGate; embedded no-auth mode
unchanged (no login page shown).

Refs: proposal 2026-09-30-ui-redesign-and-auth.md section 5 (R2,
admin-issued variant)

2026-09-30 11:16:47 +00:00

policy

Bootstrap the repository skeleton: README, agent rules, policy index, project facts

2026-09-29 17:30:32 +00:00

src

Add login page, forced password change, and admin user management

2026-09-30 11:16:47 +00:00

test

Rebuild the left nav as a task-centric sidebar (option A, R1)

2026-09-30 10:41:12 +00:00

.gitignore

Bootstrap the repository skeleton: README, agent rules, policy index, project facts