Add per-user logins alongside the shared password

The dashboard had one shared password and no concept of a user. This
adds real accounts: a username field on the login page, per-user
credentials, and the signed-in user recorded on the session, which is
the groundwork for per-user permissions later.

Credentials are salted pbkdf2 hashes in settings.json's `users` map.
Three deliberate choices there:

- settings.json rather than an env var, because a pbkdf2 hash contains
  '$' and docker compose interpolates that when it reads .env. It's also
  already the bind-mounted file that survives `up -d --build`.
- pbkdf2 rather than Werkzeug's default scrypt, which needs a hashlib
  built against OpenSSL — the macOS system Python has no hashlib.scrypt
  and would raise at hash time.
- load_users() re-reads the file per check, so adding a user or changing
  a password is live in every gunicorn worker with no restart. The old
  _runtime_password was per-worker and only ever half-applied.

Multi-user activates only once an account exists. Until then the
original LOGIN_PASSWORD path is used unchanged and the username field is
hidden, so deploying this can't lock the existing install out.
manage_users.py prompts for passwords via getpass — never echoed, never
a CLI argument — and only ever writes hashes; it refuses to remove the
last account, which would silently drop the dashboard back to the shared
password.

Two fixes carried along: login no longer requires the LOGIN_PASSWORD env
var specifically, so a settings.json-only password works instead of
locking you out; and the legacy comparison now uses hmac.compare_digest,
which the old docstring claimed but '==' didn't provide.

Also gitignores settings.json and data/ — they hold API keys and now
password hashes, were excluded from the deploy rsync but not from git.

Verified: legacy fallback still signs in with no accounts configured; a
9-case credential matrix (right/wrong user x right/wrong password, plus
the retired shared password); per-user change-password scoped to the
signed-in account and live without restart; and the add/passwd/remove
guards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -232,6 +232,48 @@ silently discards it. `data/` is likewise excluded from the deploy
 rsync, which runs `--delete` and would otherwise remove it for not
 being in the repo.
 
+## Logins
+
+Two modes, chosen by whether `settings.json` holds a non-empty `users` map:
+
+- **Multi-user** (once any account exists): username + password, each
+  password stored as a salted pbkdf2 hash under `users` in `settings.json`.
+  `verify_credentials()` is the only entry point; `load_users()` re-reads
+  the file per check, so adding a user or changing a password is live
+  immediately in every gunicorn worker — no restart, unlike the API keys.
+- **Legacy single shared password** (no accounts yet): the original
+  `LOGIN_PASSWORD` / `settings.json.login_password` path, username ignored.
+  This fallback exists so deploying multi-user support can't lock an
+  existing install out; the login page hides the username field entirely
+  until accounts exist.
+
+Manage accounts with `manage_users.py`, which prompts for passwords
+(never echoed, never a CLI argument, so they stay out of shell history)
+and only ever writes hashes:
+
+```bash
+docker exec -it arr-summary python3 manage_users.py list
+docker exec -it arr-summary python3 manage_users.py add <username>
+docker exec -it arr-summary python3 manage_users.py passwd <username>
+docker exec -it arr-summary python3 manage_users.py remove <username>
+```
+
+**Adding the first account switches the whole dashboard to per-user
+logins and the shared password stops working** — verify you can sign in
+as that user before closing the shell. `remove` refuses to delete the
+last account for the same reason.
+
+Users live in `settings.json` rather than an env var deliberately: a
+pbkdf2 hash contains `$`, which docker compose interpolates when reading
+`.env`. `PASSWORD_HASH_METHOD` is pinned to pbkdf2 rather than Werkzeug's
+default scrypt, which needs a hashlib built against OpenSSL and is absent
+on the macOS system Python.
+
+**Never put a real password in the repo** — not in `app.py`, not in
+`settings.json` committed to git, not in a fixture. `.env` and `data/`
+are gitignored and excluded from the deploy rsync precisely so secrets
+have somewhere to live; everything else here is pushed to Forgejo.
+
 A key saved through the Settings page overrides the corresponding
 `.env` value at startup (see the block after the `*_API_KEY` reads in
 `app.py`); `.env` remains the source of truth for anything never