Phase 8: optional accounts, per-user data, shared demo key

Guest-first multi-user mode behind AIDND_MULTI_USER (local installs
unchanged): signed-cookie guest sessions bootstrapped by /api/auth/me,
register upgrades the guest in place, login/logout, per-IP rate limits.
Every router scoped by user_id; Settings become per-user with the API
key Fernet-encrypted at rest and write-only through the API. Users
without a key get a server-funded demo key (OpenRouter free models,
20 turns/day, memory bank disabled on demo turns). Public read-only
demo scenarios (seed_demo.py); debug log restricted to local mode.
Frontend: auth modal + guest nudge, 401 re-establish/retry, demo
banner and key management in Settings.

Migrations 13-23 adopt existing data under a local user and encrypt
stored keys. Verified: migration on a copy of real data.db, two-session
isolation + register/login via curl and Chrome, demo cap 429, live
OpenRouter turn through the encrypted-key path, vite build + oxlint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KFsGHju9szibJJa2YJcdbg

backend/app/routers/story_cards.py

@@ -1,33 +1,54 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 
-from .. import models, schemas
+from .. import auth, models, schemas
 from ..database import get_db
 
 router = APIRouter(prefix="/api/story-cards", tags=["story-cards"])
 
 
+def _card_editable_or_404(card: models.StoryCard | None, user: models.User) -> models.StoryCard:
+    """Cards inherit their scope from the owning scenario/adventure. Public
+    (demo) scenarios are visible to everyone but editable by no one."""
+    if card is not None:
+        owner = card.scenario if card.scenario_id is not None else card.adventure
+        if owner is not None and owner.user_id == user.id:
+            return card
+    raise HTTPException(404, "Story card not found")
+
+
 @router.get("", response_model=list[schemas.StoryCardOut])
 def list_story_cards(
     scenario_id: int | None = None,
     adventure_id: int | None = None,
     db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
 ):
-    query = db.query(models.StoryCard)
+    if (scenario_id is None) == (adventure_id is None):
+        raise HTTPException(422, "Provide exactly one of scenario_id or adventure_id")
     if scenario_id is not None:
-        query = query.filter(models.StoryCard.scenario_id == scenario_id)
-    if adventure_id is not None:
-        query = query.filter(models.StoryCard.adventure_id == adventure_id)
-    return query.order_by(models.StoryCard.id).all()
+        scenario = db.get(models.Scenario, scenario_id)
+        if scenario is None or (scenario.user_id != user.id and not scenario.is_public):
+            raise HTTPException(404, "Owner not found")
+        return sorted(scenario.story_cards, key=lambda c: c.id)
+    adventure = db.get(models.Adventure, adventure_id)
+    if adventure is None or adventure.user_id != user.id:
+        raise HTTPException(404, "Owner not found")
+    return sorted(adventure.story_cards, key=lambda c: c.id)
 
 
 @router.post("", response_model=schemas.StoryCardOut, status_code=201)
-def create_story_card(payload: schemas.StoryCardCreate, db: Session = Depends(get_db)):
+def create_story_card(
+    payload: schemas.StoryCardCreate,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
     if (payload.scenario_id is None) == (payload.adventure_id is None):
         raise HTTPException(422, "Provide exactly one of scenario_id or adventure_id")
     owner_model = models.Scenario if payload.scenario_id else models.Adventure
     owner_id = payload.scenario_id or payload.adventure_id
-    if db.get(owner_model, owner_id) is None:
+    owner = db.get(owner_model, owner_id)
+    if owner is None or owner.user_id != user.id:
         raise HTTPException(404, "Owner not found")
     card = models.StoryCard(**payload.model_dump())
     db.add(card)
@@ -37,11 +58,12 @@ def create_story_card(payload: schemas.StoryCardCreate, db: Session = Depends(ge
 
 @router.patch("/{card_id}", response_model=schemas.StoryCardOut)
 def update_story_card(
-    card_id: int, payload: schemas.StoryCardUpdate, db: Session = Depends(get_db)
+    card_id: int,
+    payload: schemas.StoryCardUpdate,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
 ):
-    card = db.get(models.StoryCard, card_id)
-    if card is None:
-        raise HTTPException(404, "Story card not found")
+    card = _card_editable_or_404(db.get(models.StoryCard, card_id), user)
     for field, value in payload.model_dump(exclude_unset=True).items():
         setattr(card, field, value)
     db.commit()
@@ -49,9 +71,11 @@ def update_story_card(
 
 
 @router.delete("/{card_id}", status_code=204)
-def delete_story_card(card_id: int, db: Session = Depends(get_db)):
-    card = db.get(models.StoryCard, card_id)
-    if card is None:
-        raise HTTPException(404, "Story card not found")
+def delete_story_card(
+    card_id: int,
+    db: Session = Depends(get_db),
+    user: models.User = Depends(auth.get_current_user),
+):
+    card = _card_editable_or_404(db.get(models.StoryCard, card_id), user)
     db.delete(card)
     db.commit()