- AuthGate replaces the raw token prompt: first-run setup form (creates
the admin) when no accounts exist, email/password sign-in with a
forgot-password flow, and a collapsible raw-API-token fallback for
legacy/script setups.
- /reset is a public page where invite and password-reset links land;
success stores the fresh session and enters the dashboard.
- Users section (admin-only nav): invite by email (link always shown,
emailed when SMTP is configured), admin/disable toggles, reset links,
and delete with the shared-resources handoff spelled out.
- Sidebar shows who is signed in; sign-out revokes the session
server-side.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ws7xj5Ej623hh4GXQCYYR
Claude