Phase 8: optional accounts, per-user data, shared demo key

Guest-first multi-user mode behind AIDND_MULTI_USER (local installs
unchanged): signed-cookie guest sessions bootstrapped by /api/auth/me,
register upgrades the guest in place, login/logout, per-IP rate limits.
Every router scoped by user_id; Settings become per-user with the API
key Fernet-encrypted at rest and write-only through the API. Users
without a key get a server-funded demo key (OpenRouter free models,
20 turns/day, memory bank disabled on demo turns). Public read-only
demo scenarios (seed_demo.py); debug log restricted to local mode.
Frontend: auth modal + guest nudge, 401 re-establish/retry, demo
banner and key management in Settings.

Migrations 13-23 adopt existing data under a local user and encrypt
stored keys. Verified: migration on a copy of real data.db, two-session
isolation + register/login via curl and Chrome, demo cap 429, live
OpenRouter turn through the encrypted-key path, vite build + oxlint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KFsGHju9szibJJa2YJcdbg

backend/app/routers/settings.py

@@ -2,30 +2,44 @@ import httpx
 from fastapi import APIRouter, Depends
 from sqlalchemy.orm import Session
 
-from .. import models, schemas
+from .. import auth, models, schemas, security
 from ..database import get_db
 
 router = APIRouter(prefix="/api/settings", tags=["settings"])
 
 
-def get_settings(db: Session) -> models.Settings:
-    settings = db.get(models.Settings, 1)
+def get_settings(db: Session, user: models.User) -> models.Settings:
+    """Per-user settings row, created on first access (Phase 8: settings —
+    endpoint, key, models, memory config — are per user, not global)."""
+    settings = (
+        db.query(models.Settings).filter(models.Settings.user_id == user.id).first()
+    )
     if settings is None:
-        settings = models.Settings(id=1)
+        settings = models.Settings(user_id=user.id)
         db.add(settings)
         db.commit()
     return settings
 
 
 @router.get("", response_model=schemas.SettingsOut)
-def read_settings(db: Session = Depends(get_db)):
-    return get_settings(db)
+def read_settings(
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    return get_settings(db, user)
 
 
 @router.put("", response_model=schemas.SettingsOut)
-def update_settings(payload: schemas.SettingsUpdate, db: Session = Depends(get_db)):
-    settings = get_settings(db)
+def update_settings(
+    payload: schemas.SettingsUpdate,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    settings = get_settings(db, user)
     fields = payload.model_dump(exclude_unset=True)
+    # Write-only API key: absent = unchanged, "" = cleared, else encrypted.
+    if "api_key" in fields:
+        fields["api_key"] = security.encrypt_secret(fields["api_key"].strip())
     embedding_model_changed = (
         "embedding_model" in fields
         and fields["embedding_model"] != settings.embedding_model
@@ -35,19 +49,33 @@ def update_settings(payload: schemas.SettingsUpdate, db: Session = Depends(get_d
     if embedding_model_changed:
         # Vectors from the old model have a different dimensionality/space;
         # clear them so the post-turn task re-embeds with the new model.
-        db.query(models.Memory).update({"embedding": None})
+        # (This user's adventures only — settings are per-user now.)
+        owned = (
+            db.query(models.Adventure.id)
+            .filter(models.Adventure.user_id == user.id)
+            .scalar_subquery()
+        )
+        db.query(models.Memory).filter(models.Memory.adventure_id.in_(owned)).update(
+            {"embedding": None}, synchronize_session=False
+        )
     db.commit()
     return settings
 
 
 @router.post("/test")
-async def test_connection(db: Session = Depends(get_db)):
-    """Hit the endpoint's /models listing as a cheap connectivity check."""
-    settings = get_settings(db)
-    url = settings.endpoint_url.rstrip("/") + "/models"
+async def test_connection(
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    """Hit the endpoint's /models listing as a cheap connectivity check.
+    Tests whatever the turn engine would actually use — including the shared
+    demo endpoint when the user has no key of their own."""
+    settings = get_settings(db, user)
+    cfg = auth.resolve_provider_config(settings)
+    url = cfg.endpoint_url.rstrip("/") + "/models"
     headers = {}
-    if settings.api_key:
-        headers["Authorization"] = f"Bearer {settings.api_key}"
+    if cfg.api_key:
+        headers["Authorization"] = f"Bearer {cfg.api_key}"
     try:
         async with httpx.AsyncClient(timeout=10) as client:
             resp = await client.get(url, headers=headers)