User accounts, login before the title screen, own savegames per user, standalone download

- Service: accounts with Argon2 password hashes and session tokens; the first login creates
  the admin (shared savegames of before move to the admin); the admin creates and deletes
  users; everybody can change the password; savegames are stored and listed per user
- Game: login page before the title (only when the service is reachable), with licence and
  repository link; account page (password, logout; users for the admin); text fields with
  Tab/Enter, masked passwords, browser dialog on touch screens; long status messages wrap
- Download Standalone: DungeonCraft.html with the game embedded (built in the Docker image,
  served to logged-in users via nginx auth_request); works from file:// without server and
  opens downloaded savegames
- Without the service (standalone, local files) there is no login, savegame files as before

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -88,26 +88,34 @@ The savegame name is entered with the browser's text dialog when the name field
 
 ## Savegames
 
-When the game is served together with the savegame service (`server/`, started by `docker compose`), *Save Game* and *Load Game* open a list of savegames stored on the server: save under a new name (type it into the name field), overwrite, load or delete (overwrite and delete ask for a second click). The list is shared by everybody who can reach the game - protect a public installation, for example with a password on the reverse proxy.
+When the game is served together with the service (`server/`, started by `docker compose`), it starts with a **login**:
 
-If the service cannot be reached (for example when `www/` is opened as local files or served by a plain web server), the game falls back to savegame files: *Save Game* downloads a `.dcsave` file (JSON), *Load Game* opens the file picker; dropping the file onto the game window works too. Savegame files are also available from the server list (*Download as file* / *Load from file*).
+- The very first login creates the **admin account** with the entered name and password - do this right after installing.
+- The admin creates further users (title screen -> *Account*); every user can change the password there and log out.
+- Every user only sees the **own savegames** on the server: *Save Game* and *Load Game* open the list (save under a new name, overwrite, load, delete).
+- *Download Standalone* (title screen) downloads `DungeonCraft.html`: the whole game in one file, without login and without server. Savegame files (*Download as file*) open there as well.
+
+If the service cannot be reached (for example the standalone file, `www/` opened as local files or a plain web server), there is no login and the game uses savegame files: *Save Game* downloads a `.dcsave` file (JSON), *Load Game* opens the file picker; dropping the file onto the game window works too.
 
 The game also autosaves into the browser every two minutes and when the tab is closed; *Continue* on the title screen resumes from there.
 
 ### Savegame service
 
-A small Rust service (axum) in `server/` stores savegames as files in the Docker volume `savegames`. nginx forwards `/api/` to it; the service itself is not published.
+A small Rust service (axum) in `server/` keeps the user accounts (Argon2 password hashes) and the savegames as files in the Docker volume `savegames` (one folder per user). nginx forwards `/api/` to it; the service itself is not published. The standalone file is served under `/standalone/` only for logged-in users (nginx `auth_request`).
 
 | Request | Meaning |
 |---|---|
-| `GET /api/health` | `ok` when the service runs |
-| `GET /api/saves` | list (id, name, date, map size, wave, play time), newest first |
+| `GET /api/health` | `ok` when the service runs (`ok setup` while there is no account yet) |
+| `POST /api/login` | `{name, password}` -> `{token, name, admin}`; the first login creates the admin |
+| `POST /api/logout`, `GET /api/me`, `POST /api/password` | session, own account, change password |
+| `GET/POST /api/users`, `DELETE /api/users/{name}` | admin: list, create, delete users |
+| `GET /api/saves` | own savegames (id, name, date, map size, wave, play time), newest first |
 | `POST /api/saves?name=...` | store a new savegame (body: savegame JSON) |
 | `PUT /api/saves/{id}?name=...` | overwrite a savegame |
 | `GET /api/saves/{id}` | savegame JSON |
 | `DELETE /api/saves/{id}` | delete a savegame |
 
-Limits: 1 MB per savegame, 500 MB in total, 30 write requests per minute. Settings: `SAVE_DIR` (default `/data`), `LISTEN` (default `0.0.0.0:8080`).
+All requests except health and login need `Authorization: Bearer <token>`. Limits: 1 MB per savegame, 500 MB in total, 30 write requests and 20 login attempts per minute. Settings: `SAVE_DIR` (default `/data`), `LISTEN` (default `0.0.0.0:8080`).
 
 ## Adding a language