Users, with their own settings, and a list of where each is signed in

The login is a user name and a password. The old single password becomes the account
named after the OS user on first boot, along with its sessions and the machine-wide look.
Settings gains Users (add, remove, reset a password — your own password confirms) and
Sessions (device, IP, last seen; revoke one or sign out everywhere else). Theme, accents
and the dashboard layout follow the account; the refresh rate, graph history and alerts
stay the machine's. Pairing a machine takes a user on it. Log lines name the actor.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/config/config.go

@@ -24,6 +24,8 @@ type Token struct {
 	Scope string `json:"scope,omitempty"`
 	// Sensors narrows a sensors:read token to the IDs these patterns match. Empty is all.
 	Sensors []string `json:"sensors,omitempty"`
+	// IssuedBy is the account that made the token (or paired the hub that holds it).
+	IssuedBy string `json:"issued_by,omitempty"`
 }
 
 const ScopeSensorsRead = "sensors:read"
@@ -38,9 +40,20 @@ type Node struct {
 	Added       time.Time `json:"added"`
 }
 
+// User is an account on this machine's console. Only the argon2id hash is kept.
+type User struct {
+	Name     string    `json:"name"`
+	Hash     string    `json:"hash"`
+	Created  time.Time `json:"created"`
+	LastSeen time.Time `json:"last_seen,omitempty"`
+}
+
 type Config struct {
-	Listen       string  `json:"listen"`
-	PasswordHash string  `json:"password_hash"`
+	Listen string `json:"listen"`
+	// PasswordHash is the single login of installs before users existed. On load it becomes
+	// the first user (see MigrateUsers) and is then dropped from the file.
+	PasswordHash string `json:"password_hash,omitempty"`
+	Users        []User `json:"users,omitempty"`
 	TLS          string  `json:"tls,omitempty"` // "auto" → self-signed cert in the data dir; "" → plain HTTP
 	Tokens       []Token `json:"tokens,omitempty"`
 	Nodes        []Node  `json:"nodes,omitempty"`
@@ -91,6 +104,27 @@ func Load(path string) (*Config, error) {
 	return c, nil
 }
 
+// MigrateUsers turns the pre-users single password into the first account, named after
+// the OS user the console runs as. Reports whether anything changed (the caller saves).
+func (c *Config) MigrateUsers(name string) bool {
+	if len(c.Users) > 0 || c.PasswordHash == "" {
+		return false
+	}
+	c.Users = []User{{Name: name, Hash: c.PasswordHash, Created: time.Now()}}
+	c.PasswordHash = ""
+	return true
+}
+
+// User finds an account by name. Call under View/Update or on a config nobody else holds.
+func (c *Config) User(name string) (User, bool) {
+	for _, u := range c.Users {
+		if u.Name == name {
+			return u, true
+		}
+	}
+	return User{}, false
+}
+
 func (c *Config) Path() string    { return c.path }
 func (c *Config) DataDir() string { return filepath.Dir(c.path) }