2 Commits

Include renames

Author	SHA1	Message	Date
peter	b1832afd18	style: apply ruff format across backend + scripts (line-length 100) ... Mechanical, whole-tree `ruff format` pass — no behaviour change. Recorded in .git-blame-ignore-revs (next commit) so git blame skips it.	2026-08-23 07:43:06 +02:00
peter	7efd4f4867	feat(auth): email+password registration with two-gate activation (5a backend) ... Add email+password auth alongside Google: argon2id hashing; users gains password_hash/email_verified/is_active and google_sub becomes nullable (migration 0022); a single-use, hashed auth_tokens table for email verification + password reset. Registration creates a pending (inactive, unverified) account + an access request; sign-in needs verified email AND admin approval. Anti-enumeration: uniform register/login/reset responses (a correct-password owner still gets a specific pending reason). allow_registration flag (DB-tunable). Admin users-list + role endpoint (guards: not self, not demo, not the last admin); approving access (or a manual whitelist add) now activates the matching pending account. current_user rejects deactivated accounts. Verified end-to-end via curl + DB.	2026-06-19 14:03:11 +02:00