feat: account sessions and usable template editors

README.md

@@ -19,7 +19,7 @@ FRAME_FLOW_TOKEN. Read that token locally in an editor and enter it on the login
 screen. Do not paste a KoKonna API Key into Web UI. Demo always forces mock mode
 and disables real writes. It leaves data persistent in ./data and ./config.
 
-打开页面后输入 `.env` 中的 FRAME_FLOW_TOKEN；Token 只留在当前页面内存，刷新后需重新输入。
+网页使用账号密码登录。通过 `python scripts/create-account.py --username YOUR_NAME` 创建账号，再启动服务；密码不会写入代码或明文配置。勾选记住登录可保持 30 天，设置页面可修改密码或退出。
 
 ## Architecture / 架构
 
@@ -90,12 +90,16 @@ until the owner explicitly authorizes it.** Test design: [REAL_DEVICE_TEST.md](d
 
 All protected /api/v1 capabilities use Frame Flow Bearer auth and scope checks.
 SQLite stores token hashes. Device keys live only in env/secret and runtime memory.
-The optional 30-day Remember login stores only the Frame Flow Token in this browser
-localStorage. Disconnect, expiry or HTTP 401 clears it; shared browsers should opt out.
-Cloud original-image endpoint embeds a key upstream; backend proxies it with no
-redirects and no access/transport logging. Key never enters browser URLs or DB.
-Request validation and exceptions use sanitized standard errors. Strong tokens,
-trusted LAN and no public exposure are the intended deployment model.
+Browser login uses SQLite accounts with salted scrypt password hashes and revocable,
+HttpOnly/SameSite=Strict cookies (30 days when remembered, 12 hours otherwise).
+Mutations require a session CSRF header. Logout and password changes revoke sessions.
+Passwords and browser sessions are never stored in localStorage. Bootstrap hashes
+in private `config/accounts.json` seed new accounts only; restarting does not undo
+a password change. Five failed logins per source IP cause a five-minute lockout.
+The browser needs no API Token. Bearer authentication remains compatible for
+external clients; the KoKonna key is never used for account login.
+The LAN deployment uses HTTP; use an explicitly configured HTTPS endpoint if
+transport encryption is needed. No reverse proxy or firewall is changed automatically.
 
 ## API
 
@@ -161,3 +165,14 @@ status is recorded honestly in docs/ACCEPTANCE.md.
 Additional drivers; scoped token administration; signed webhooks; cache retention;
 face-aware cropping; public weather provider; Google Calendar, Home Assistant, MQTT,
 NAS monitoring and AI integrations through the same API. External integration is optional.
+
+## Template editing
+
+Templates provide bilingual form fields, event lists, local photo selection, advanced
+JSON, color/grayscale previews, persistent defaults and reset to built-in defaults.
+Changing content invalidates the previous preview. Weather uses the labeled Mock
+provider until a real provider is configured. Live display controls stay disabled
+until real writes are separately approved.
+
+Browser smoke tests use a disposable Mock account via FRAME_FLOW_TEST_USERNAME
+and FRAME_FLOW_TEST_PASSWORD; never run the mutation smoke suite against live devices.