2 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	1af3a6e90a	feat(auth): server-side sessions and current password for account changes (FLAW-30, FLAW-31) ... - Every login is a session (device, IP, last use); the token's jti is its ID. Sessions end on logout, per device from the profile, or after 30 idle days. - Tokens older than a day are renewed via the X-Session-Token header. - Changing password or login e-mail needs the current password; a new password logs out all other devices and mails the old address. - Demo reset keeps the demo visitors' sessions. - revoked_tokens is replaced by sessions (migration 4); everyone is logged out once after the upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 19:25:22 +01:00
sandrodachandClaude Opus 5.5	dc44f8250c	fix(db): numbered migrations that run once and fail loudly (FLAW-13) ... schema_migrations records every applied step; the former migrate() is step 3, the baseline that builds the v0.4.1 schema and repairs older databases. Columns are only added when missing, so every other error now stops the start with a clear message instead of being swallowed, and the cleanup statements no longer run on each start. migrations/001_init.sql was never read and is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 14:49:35 +01:00