Phase 8: optional accounts, per-user data, shared demo key

Guest-first multi-user mode behind AIDND_MULTI_USER (local installs
unchanged): signed-cookie guest sessions bootstrapped by /api/auth/me,
register upgrades the guest in place, login/logout, per-IP rate limits.
Every router scoped by user_id; Settings become per-user with the API
key Fernet-encrypted at rest and write-only through the API. Users
without a key get a server-funded demo key (OpenRouter free models,
20 turns/day, memory bank disabled on demo turns). Public read-only
demo scenarios (seed_demo.py); debug log restricted to local mode.
Frontend: auth modal + guest nudge, 401 re-establish/retry, demo
banner and key management in Settings.

Migrations 13-23 adopt existing data under a local user and encrypt
stored keys. Verified: migration on a copy of real data.db, two-session
isolation + register/login via curl and Chrome, demo cap 429, live
OpenRouter turn through the encrypted-key path, vite build + oxlint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KFsGHju9szibJJa2YJcdbg

backend/app/routers/auth.py

@@ -0,0 +1,120 @@
+import re
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from sqlalchemy.orm import Session
+
+from .. import auth, models, schemas, security
+from ..database import get_db
+from .settings import get_settings
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
+
+
+def _set_session_cookie(response: Response, user_id: int) -> None:
+    response.set_cookie(
+        auth.SESSION_COOKIE,
+        security.sign_session(user_id),
+        max_age=auth.COOKIE_MAX_AGE,
+        httponly=True,
+        samesite="lax",
+        secure=auth.COOKIE_SECURE,
+        path="/",
+    )
+
+
+def me_payload(user: models.User, db: Session) -> dict:
+    settings = get_settings(db, user)
+    cfg = auth.resolve_provider_config(settings)
+    return {
+        "multi_user": auth.MULTI_USER,
+        "id": user.id,
+        "email": user.email,
+        "is_guest": user.is_guest,
+        "demo": {
+            "enabled": auth.demo_enabled(),
+            "using_demo": cfg.using_demo,
+            "model": cfg.model if cfg.using_demo else None,
+            "turns_per_day": auth.DEMO_TURNS_PER_DAY,
+            "turns_left": auth.demo_turns_left(user) if auth.demo_enabled() else None,
+            "models": auth.DEMO_MODELS if auth.demo_enabled() else [],
+        },
+    }
+
+
+@router.get("/me")
+def me(request: Request, response: Response, db: Session = Depends(get_db)):
+    """Who am I? In multi-user mode this also bootstraps the session: with no
+    (or an invalid) cookie it creates a guest user and sets one — the
+    frontend calls this on load and after any 401."""
+    if not auth.MULTI_USER:
+        user = auth.local_user(db)
+    else:
+        user = auth.resolve_session_user(request, db)
+        if user is None:
+            user = models.User(is_guest=True)
+            db.add(user)
+            db.commit()
+            _set_session_cookie(response, user.id)
+    return me_payload(user, db)
+
+
+@router.post("/register")
+def register(
+    payload: schemas.AuthCredentials,
+    request: Request,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    """Upgrade the current guest in place — same user_id, so every adventure,
+    scenario, script and setting they created as a guest is kept."""
+    if not auth.MULTI_USER:
+        raise HTTPException(400, "Accounts are disabled in local mode.")
+    auth.rate_limit_auth(request)
+    email = payload.email.strip().lower()
+    if not EMAIL_RE.match(email):
+        raise HTTPException(422, "Enter a valid email address.")
+    if len(payload.password) < 8:
+        raise HTTPException(422, "Password must be at least 8 characters.")
+    if not user.is_guest:
+        raise HTTPException(400, "This session is already registered.")
+    if db.query(models.User).filter(models.User.email == email).first():
+        raise HTTPException(409, "An account with this email already exists — log in instead.")
+    user.email = email
+    user.password_hash = security.hash_password(payload.password)
+    user.is_guest = False
+    db.commit()
+    return me_payload(user, db)
+
+
+@router.post("/login")
+def login(
+    payload: schemas.AuthCredentials,
+    request: Request,
+    response: Response,
+    db: Session = Depends(get_db),
+):
+    """Point this browser's session at an existing account. Any current guest
+    session is simply abandoned (its data stays under the guest user)."""
+    if not auth.MULTI_USER:
+        raise HTTPException(400, "Accounts are disabled in local mode.")
+    auth.rate_limit_auth(request)
+    email = payload.email.strip().lower()
+    user = db.query(models.User).filter(models.User.email == email).first()
+    if (
+        user is None
+        or not user.password_hash
+        or not security.verify_password(payload.password, user.password_hash)
+    ):
+        raise HTTPException(401, "Incorrect email or password.")
+    _set_session_cookie(response, user.id)
+    return me_payload(user, db)
+
+
+@router.post("/logout")
+def logout(response: Response):
+    if not auth.MULTI_USER:
+        raise HTTPException(400, "Accounts are disabled in local mode.")
+    response.delete_cookie(auth.SESSION_COOKIE, path="/")
+    return {"ok": True}