Users, with their own settings, and a list of where each is signed in

The login is a user name and a password. The old single password becomes the account
named after the OS user on first boot, along with its sessions and the machine-wide look.
Settings gains Users (add, remove, reset a password — your own password confirms) and
Sessions (device, IP, last seen; revoke one or sign out everywhere else). Theme, accents
and the dashboard layout follow the account; the refresh rate, graph history and alerts
stay the machine's. Pairing a machine takes a user on it. Log lines name the actor.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/setup/setup.go

@@ -175,14 +175,23 @@ func Install(args []string, version string) error {
 		return fmt.Errorf("--tls %q: want auto or off", o.tls)
 	}
 	generated := ""
-	if cfg.PasswordHash == "" || o.passwordStdin {
+	cfg.MigrateUsers(acct.name)
+	if len(cfg.Users) == 0 || o.passwordStdin {
 		pw, gen, err := choosePassword(o.passwordStdin)
 		if err != nil {
 			return err
 		}
-		if cfg.PasswordHash, err = auth.HashPassword(pw); err != nil {
+		h, err := auth.HashPassword(pw)
+		if err != nil {
 			return err
 		}
+		// the first account is named after the OS user the service runs as; --password-stdin
+		// on an existing install resets that first account
+		if len(cfg.Users) == 0 {
+			cfg.Users = []config.User{{Name: acct.name, Hash: h, Created: time.Now()}}
+		} else {
+			cfg.Users[0].Hash = h
+		}
 		if gen {
 			generated = pw
 		}
@@ -257,7 +266,7 @@ func Install(args []string, version string) error {
 		say("\nInstalled, but %s isn't answering yet. Check: %s", url, map[string]string{"systemd": "journalctl -u hamlab -n 30", "OpenRC": "tail /var/log/hamlab.log"}[initSys])
 	}
 	if generated != "" {
-		say("Login password (shown once; change it in Settings): %s", generated)
+		say("Login: user %s, password (shown once; change it in Settings): %s", cfg.Users[0].Name, generated)
 	}
 	if host, _, _ := net.SplitHostPort(cfg.Listen); isLoopback(host) {
 		say("It only listens on this machine. For LAN access: hamlab install --listen 0.0.0.0:%s", port)