added multi user support, move api key to database

frontend/README.md

@@ -2,8 +2,10 @@
 
 Web UI for the [`radapi`](../radapi) FreeRADIUS REST API. Manage **clients**
 (customer MACs), **devices** (NAS/AP boxes seen in accounting), and **VLANs**
-without touching SQL. Auth is an **API key** entered on a login screen and stored in
-the browser (`localStorage`), sent as `X-API-Key` on every request.
+without touching SQL. Admins also manage **users**, **API keys**, and view an
+**activity log**. Auth is a username/password login; the backend returns a session
+token stored in the browser (`localStorage`) and sent as `Authorization: Bearer`
+on every request.
 
 ## Stack
 
@@ -29,15 +31,16 @@ nix-shell --run "npm run dev -- --host 0.0.0.0"
 ### Talking to the API
 
 In dev, Vite proxies `/api/*` to the backend so the browser makes same-origin
-requests (no CORS) and the key is only ever sent as a header. The target defaults
+requests (no CORS) and the token is only ever sent as a header. The target defaults
 to `http://10.0.1.235:8000`; override it:
 
 ```bash
 VITE_API_TARGET=http://192.168.1.21:8000 npm run dev
 ```
 
-Log in with the API key configured in radapi's `.env` (`API_KEY`). A `401` from any
-request clears the stored key and returns you to the login screen.
+Log in with **`admin` / `admin`** on first run (you'll be prompted to change the
+password), then create real users from the **Users** page. A `401` from any request
+clears the stored token and returns you to the login screen.
 
 ## Build
 
@@ -54,12 +57,16 @@ API (or set `VITE_API_BASE` to the API's absolute URL at build time).
 ```
 src/
   main.tsx            providers (router, auth, toaster)
-  App.tsx             auth gate + nav + routes
-  auth/auth.tsx       API-key auth context (login/logout, 401 handling)
-  lib/api.ts          typed API client (client + device + vlan) + error handling
+  App.tsx             auth gate + forced-password-change + nav (role-gated) + routes
+  auth/auth.tsx       session auth context (login/logout, current user, 401 handling)
+  lib/api.ts          typed API client (auth + users + apikeys + logs + client/device/vlan)
   lib/utils.ts        cn() helper
   pages/
-    Login.tsx         API-key login screen
+    Login.tsx         username/password login screen
+    ChangePassword.tsx  change own password (also the forced first-login screen)
+    Users.tsx         admin: list/create/delete users + reset password
+    ApiKeys.tsx       admin: create (shown once) / list / revoke API keys
+    Logs.tsx          admin: paginated activity log
     Clients.tsx       client list + add/edit/delete + CSV import/export dialogs
     Devices.tsx       NAS device list + editable alias
     Vlans.tsx         VLAN list + add/rename/delete dialogs