fix(auth): implement DB-first auth, persistent bearer token, secure cookies, and CLI reset_password script

app/main.py

@@ -215,7 +215,12 @@ async def index_page(request: Request):
 
 @app.post("/api/login")
 async def api_login(req: LoginRequest, request: Request, response: Response):
-    ip = request.client.host if request.client else "unknown"
+    forwarded = request.headers.get("x-forwarded-for")
+    if forwarded:
+        ip = forwarded.split(",")[0].strip()
+    else:
+        ip = request.headers.get("x-real-ip") or (request.client.host if request.client else "unknown")
+
     if not check_login_rate_limit(ip):
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
@@ -234,15 +239,21 @@ async def api_login(req: LoginRequest, request: Request, response: Response):
     user_agent = request.headers.get("User-Agent", "")
     session_token = create_session(user["id"], user_agent=user_agent, ip=ip)
 
+    is_secure = request.headers.get("x-forwarded-proto", "").lower() == "https" or request.url.scheme == "https"
     response.set_cookie(
         key=config.SESSION_COOKIE_NAME,
         value=session_token,
         max_age=config.SESSION_MAX_AGE,
         httponly=True,
         samesite="lax",
-        secure=False,
+        secure=is_secure,
     )
-    return {"status": "ok", "user": {"id": user["id"], "username": user["username"]}}
+    return {
+        "status": "ok",
+        "user": {"id": user["id"], "username": user["username"]},
+        "token": session_token,
+    }
+
 
 
 @app.post("/api/logout")

app/static/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
     <title>Notes — Персональный тренажер и словарь английского языка</title>
     <meta name="description" content="Защищённый персональный тренажёр и словарь английского языка с интервальными повторениями SRS SM-2, контекстным поиском и озвучкой">
-    <link rel="stylesheet" href="/static/css/style.css?v=2.8">
+    <link rel="stylesheet" href="/static/css/style.css?v=2.9">
     
     <!-- PWA meta and icons -->
     <link rel="manifest" href="/manifest.json">
@@ -928,6 +928,7 @@
     <!-- Audio Element for native streaming -->
     <audio id="global-audio-player" preload="none"></audio>
 
-    <script src="/static/js/app.js?v=2.8"></script>
+    <script src="/static/js/app.js?v=2.9"></script>
 </body>
 </html>
+

app/static/js/app.js

@@ -1,5 +1,27 @@
 // Notes Application Frontend Logic - Complete SRS, Heatmap, Quiz, and Analytics
-document.addEventListener('DOMContentLoaded', () => {
+    // Persistent session: auto-inject Authorization header if token exists in localStorage
+    const originalFetch = window.fetch;
+    window.fetch = function(url, options = {}) {
+        const token = localStorage.getItem('notes_token');
+        if (token && typeof url === 'string' && url.startsWith('/api/')) {
+            options.headers = options.headers || {};
+            if (options.headers instanceof Headers) {
+                if (!options.headers.has('Authorization')) {
+                    options.headers.set('Authorization', `Bearer ${token}`);
+                }
+            } else if (Array.isArray(options.headers)) {
+                if (!options.headers.some(([k]) => k.toLowerCase() === 'authorization')) {
+                    options.headers.push(['Authorization', `Bearer ${token}`]);
+                }
+            } else {
+                if (!options.headers['Authorization']) {
+                    options.headers['Authorization'] = `Bearer ${token}`;
+                }
+            }
+        }
+        return originalFetch.call(this, url, options);
+    };
+
     // Register PWA Service Worker
     if ('serviceWorker' in navigator) {
         navigator.serviceWorker.register('/sw.js', { scope: '/' })
@@ -7,6 +29,7 @@ document.addEventListener('DOMContentLoaded', () => {
             .catch(err => console.log('Notes ServiceWorker failed:', err));
     }
 
+
     // App State
     let currentUser = null;
     let currentLookupData = null;
@@ -385,6 +408,9 @@ document.addEventListener('DOMContentLoaded', () => {
             });
             const data = await resp.json();
             if (resp.ok && data.status === 'ok') {
+                if (data.token) {
+                    localStorage.setItem('notes_token', data.token);
+                }
                 currentUser = data.user;
                 showApp();
                 loadInitialData();
@@ -399,11 +425,13 @@ document.addEventListener('DOMContentLoaded', () => {
     });
 
     logoutBtn.addEventListener('click', async () => {
+        localStorage.removeItem('notes_token');
         await fetch('/api/logout', { method: 'POST' });
         currentUser = null;
         window.location.reload();
     });
 
+
     // -----------------------------------------------------------------------
     // Data Loading: Cards, Collections, Tags, Stats
     // -----------------------------------------------------------------------