fix(auth): implement DB-first auth, persistent bearer token, secure cookies, and CLI reset_password script

app/main.py

@@ -215,7 +215,12 @@ async def index_page(request: Request):
 
 @app.post("/api/login")
 async def api_login(req: LoginRequest, request: Request, response: Response):
-    ip = request.client.host if request.client else "unknown"
+    forwarded = request.headers.get("x-forwarded-for")
+    if forwarded:
+        ip = forwarded.split(",")[0].strip()
+    else:
+        ip = request.headers.get("x-real-ip") or (request.client.host if request.client else "unknown")
+
     if not check_login_rate_limit(ip):
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
@@ -234,15 +239,21 @@ async def api_login(req: LoginRequest, request: Request, response: Response):
     user_agent = request.headers.get("User-Agent", "")
     session_token = create_session(user["id"], user_agent=user_agent, ip=ip)
 
+    is_secure = request.headers.get("x-forwarded-proto", "").lower() == "https" or request.url.scheme == "https"
     response.set_cookie(
         key=config.SESSION_COOKIE_NAME,
         value=session_token,
         max_age=config.SESSION_MAX_AGE,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=is_secure,
     )
-    return {"status": "ok", "user": {"id": user["id"], "username": user["username"]}}
+    return {
+        "status": "ok",
+        "user": {"id": user["id"], "username": user["username"]},
+        "token": session_token,
+    }
+
 
 
 @app.post("/api/logout")