Users, with their own settings, and a list of where each is signed in

The login is a user name and a password. The old single password becomes the account
named after the OS user on first boot, along with its sessions and the machine-wide look.
Settings gains Users (add, remove, reset a password — your own password confirms) and
Sessions (device, IP, last seen; revoke one or sign out everywhere else). Theme, accents
and the dashboard layout follow the account; the refresh rate, graph history and alerts
stay the machine's. Pairing a machine takes a user on it. Log lines name the actor.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -35,16 +35,24 @@ checks it against `SHA256SUMS` and runs `hamlab install`; re-running it upgrades
 - gets root through `sudo` or `doas` if you aren't root already, and runs the console as
   **you** (`--user`), so terminals are your login shell with your rights;
 - writes the config to `~/.config/hamlab/` (`--data`; an existing `~/apps/hamlab/` is kept)
-  and asks for the login password, or generates one and prints it once
-  (`--password-stdin` for scripts);
+  and asks for the first account's password (the account is named after the user the
+  console runs as), or generates one and prints it once (`--password-stdin` for scripts);
 - registers a boot-time service with **systemd** or **OpenRC**, naming only groups that
   exist on the host, and waits for `/healthz`; with neither init it prints the one line
   to put under your own supervisor;
 - says so when firewalld or ufw will block the port (`--open-firewall` opens it).
 
-Re-running it upgrades in place and keeps config, user and password. `hamlab uninstall
+Re-running it upgrades in place and keeps config, user and accounts. `hamlab uninstall
 [--purge]` reverses it.
 
+Accounts: every person has their own user name and password, and the theme, accent
+colours and dashboard layout follow the account. Manage them under **Settings → Users**
+(add, remove, reset a password; your own password confirms the last two) or from the
+shell: `hamlab passwd [user]` sets a password and makes the account if it is new,
+`hamlab users` lists them, `hamlab user-rm <user>` removes one. **Settings → Sessions**
+shows where you are signed in and signs out any device. Machine settings — refresh rate,
+graph history, alert rules — stay the machine's and are shared by everyone.
+
 What adapts to the host, rather than assuming Debian:
 
 | | |
@@ -67,7 +75,8 @@ Terminals run as the user the service runs as, with that user's login shell.
 Install Ham Lab on each host; on the ones the hub should reach:
 `hamlab install --listen <lan-ip>:8100 --tls auto` (a self-signed certificate is generated
 on first start). Then on the hub, open **Machines**, enter a name, the address
-(`https://host:8100`) and that machine's Ham Lab password once. The hub pins the
+(`https://host:8100`) and a user and password on that machine once (the user may be
+left out when it has only one). The hub pins the
 certificate, keeps an access token, and every tab works against the chosen machine
 through the switcher at the top of the rail.