Phase 8: optional accounts, per-user data, shared demo key

Guest-first multi-user mode behind AIDND_MULTI_USER (local installs
unchanged): signed-cookie guest sessions bootstrapped by /api/auth/me,
register upgrades the guest in place, login/logout, per-IP rate limits.
Every router scoped by user_id; Settings become per-user with the API
key Fernet-encrypted at rest and write-only through the API. Users
without a key get a server-funded demo key (OpenRouter free models,
20 turns/day, memory bank disabled on demo turns). Public read-only
demo scenarios (seed_demo.py); debug log restricted to local mode.
Frontend: auth modal + guest nudge, 401 re-establish/retry, demo
banner and key management in Settings.

Migrations 13-23 adopt existing data under a local user and encrypt
stored keys. Verified: migration on a copy of real data.db, two-session
isolation + register/login via curl and Chrome, demo cap 429, live
OpenRouter turn through the encrypted-key path, vite build + oxlint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KFsGHju9szibJJa2YJcdbg

backend/app/routers/debug.py

@@ -1,11 +1,17 @@
-from fastapi import APIRouter
+from fastapi import APIRouter, HTTPException
 
-from .. import debuglog
+from .. import auth, debuglog
 
 router = APIRouter(prefix="/api/debug", tags=["debug"])
 
 
 @router.get("/requests")
 def recent_requests():
-    """Most-recent-first log of provider requests/responses (no API keys)."""
+    """Most-recent-first log of provider requests/responses (no API keys).
+
+    The log is a single process-wide ring buffer with no per-user
+    attribution, so in multi-user (hosted) mode it would leak other players'
+    prompts — disabled there, available on local installs."""
+    if auth.MULTI_USER:
+        raise HTTPException(403, "The debug log is only available on local installs.")
     return debuglog.recent()