Phase 8: optional accounts, per-user data, shared demo key

Guest-first multi-user mode behind AIDND_MULTI_USER (local installs
unchanged): signed-cookie guest sessions bootstrapped by /api/auth/me,
register upgrades the guest in place, login/logout, per-IP rate limits.
Every router scoped by user_id; Settings become per-user with the API
key Fernet-encrypted at rest and write-only through the API. Users
without a key get a server-funded demo key (OpenRouter free models,
20 turns/day, memory bank disabled on demo turns). Public read-only
demo scenarios (seed_demo.py); debug log restricted to local mode.
Frontend: auth modal + guest nudge, 401 re-establish/retry, demo
banner and key management in Settings.

Migrations 13-23 adopt existing data under a local user and encrypt
stored keys. Verified: migration on a copy of real data.db, two-session
isolation + register/login via curl and Chrome, demo cap 429, live
OpenRouter turn through the encrypted-key path, vite build + oxlint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KFsGHju9szibJJa2YJcdbg

frontend/src/api.js

@@ -1,8 +1,19 @@
-async function request(path, options = {}) {
+// Multi-user mode: a 401 means our session cookie is missing/stale. Hitting
+// /api/auth/me creates a fresh guest session, after which the original call
+// is retried once.
+async function ensureSession() {
+  await fetch('/api/auth/me')
+}
+
+async function request(path, options = {}, isRetry = false) {
   const resp = await fetch(`/api${path}`, {
     headers: { 'Content-Type': 'application/json' },
     ...options,
   })
+  if (resp.status === 401 && !isRetry && path !== '/auth/me') {
+    await ensureSession()
+    return request(path, options, true)
+  }
   if (!resp.ok) {
     let detail = resp.statusText
     try {
@@ -16,13 +27,17 @@ async function request(path, options = {}) {
 }
 
 // POSTs to an SSE endpoint and dispatches events: {type: 'player'|'chunk'|'done'|'error', ...}
-async function streamSSE(path, payload, onEvent, signal) {
+async function streamSSE(path, payload, onEvent, signal, isRetry = false) {
   const resp = await fetch(`/api${path}`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(payload),
     signal,
   })
+  if (resp.status === 401 && !isRetry) {
+    await ensureSession()
+    return streamSSE(path, payload, onEvent, signal, true)
+  }
   if (!resp.ok) {
     let detail = resp.statusText
     try { detail = (await resp.json()).detail || detail } catch { /* non-JSON */ }
@@ -46,6 +61,14 @@ async function streamSSE(path, payload, onEvent, signal) {
 }
 
 export const api = {
+  // Auth (Phase 8 — no-ops in local mode beyond getMe)
+  getMe: () => request('/auth/me'),
+  register: (email, password) =>
+    request('/auth/register', { method: 'POST', body: JSON.stringify({ email, password }) }),
+  login: (email, password) =>
+    request('/auth/login', { method: 'POST', body: JSON.stringify({ email, password }) }),
+  logout: () => request('/auth/logout', { method: 'POST' }),
+
   // Scenarios
   listScenarios: () => request('/scenarios'),
   getScenario: (id) => request(`/scenarios/${id}`),