feat: multi-user auth with per-user media isolation

Introduce username/password authentication with admin and user roles.
Each user gets their own media directory under /photos/{username}/ with
isolated photos, folders, heaps, and tags. Admins manage users and
observe the full library from a dedicated Settings page.

Backend:
- User model with bcrypt passwords and JWT access/refresh tokens
- Auth router (login, refresh, setup, change-password, status)
- Admin router (user CRUD with last-admin protection)
- user_id FK added to photos, folders, source_roots, heaps, tags
- All data routers scoped by authenticated user
- Scanner inherits user_id from source root owner
- Thumbnails stored under user-prefixed paths for isolation
- Library endpoints accept ?scope=global for admin cross-user view
- Alembic migration 0009 with data migration for existing installs
- Defensive bootstrap.py handles fresh vs existing DB startup

Frontend:
- AuthContext with token lifecycle, auto-refresh, login/logout
- Login page, first-run setup page, auth gate in App.tsx
- Bearer token interceptor on all API requests
- User identity + logout in left sidebar
- Admin-only Settings page with Library Management and Users tabs
- UserManagement panel (add, edit role, reset password, deactivate)
- Settings shows global stats across all users for admin
- Filter bar, right sidebar, keyboard hints hidden on settings page

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -1,6 +1,7 @@
 """
 Database models for Mulita
 """
+from app.models.user import User
 from app.models.photos import Photo
 from app.models.folders import Folder, SourceRoot
 from app.models.tags import Tag, PhotoTag
@@ -10,6 +11,7 @@ from app.models.ocr_text import OCRText
 from app.models.face_embedding import FaceEmbedding
 
 __all__ = [
+    'User',
     'Photo',
     'Folder',
     'SourceRoot',

backend/app/models/folders.py

@@ -10,13 +10,16 @@ from app.database import Base
 
 class SourceRoot(Base):
     __tablename__ = 'source_roots'
-    
+
     id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
     name = Column(String, nullable=False)
     path = Column(String, unique=True, nullable=False)
     is_active = Column(Boolean, default=True)
     added_at = Column(DateTime, server_default=func.now())
-    
+
+    # Owner
+    user_id = Column(String, ForeignKey('users.id'), nullable=True, index=True)
+
     # Relationships
     folders = relationship("Folder", back_populates="source_root")
 
@@ -28,6 +31,9 @@ class Folder(Base):
     path = Column(String, unique=True, nullable=False)
     parent_id = Column(String, ForeignKey('folders.id'))
     source_root_id = Column(String, ForeignKey('source_roots.id'))
+
+    # Owner
+    user_id = Column(String, ForeignKey('users.id'), nullable=True, index=True)
     photo_count = Column(Integer, default=0)
     last_scanned = Column(DateTime)
 

backend/app/models/heaps.py

@@ -22,12 +22,15 @@ heap_photos = Table(
 
 class Heap(Base):
     __tablename__ = 'heaps'
-    
+
     id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
     name = Column(String, nullable=False)
     created_at = Column(DateTime, server_default=func.now())
     updated_at = Column(DateTime, onupdate=func.now())
     is_active = Column(Boolean, default=False)  # For active heap feature
+
+    # Owner
+    user_id = Column(String, ForeignKey('users.id'), nullable=True, index=True)
     
     # Relationships
     photos = relationship("Photo", secondary=heap_photos, backref="heaps")

backend/app/models/photos.py

@@ -14,6 +14,9 @@ class Photo(Base):
     # Primary key
     id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
     
+    # Owner
+    user_id = Column(String, ForeignKey('users.id'), nullable=True, index=True)
+
     # File information
     filepath = Column(String, unique=True, nullable=False)
     filename = Column(String, nullable=False)

backend/app/models/tags.py

@@ -30,13 +30,16 @@ photo_tags = Table(
 class Tag(Base):
     __tablename__ = 'tags'
     __table_args__ = (
-        UniqueConstraint('name', 'kind', name='uq_tags_name_kind'),
+        UniqueConstraint('name', 'kind', 'user_id', name='uq_tags_name_kind_user'),
     )
 
     id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
     name = Column(String, nullable=False, index=True)
     color = Column(String)  # Hex color code for UI display
 
+    # Owner
+    user_id = Column(String, ForeignKey('users.id'), nullable=True, index=True)
+
     # Tag classification
     kind = Column(String, nullable=False, default='user', index=True)
     # kind values: 'user' | 'object' | 'scene' | 'face_cluster'

backend/app/models/user.py

@@ -0,0 +1,23 @@
+"""
+User model definition
+"""
+from sqlalchemy import Column, String, Boolean, DateTime
+from sqlalchemy.sql import func
+import uuid
+
+from app.database import Base
+
+
+class User(Base):
+    __tablename__ = 'users'
+
+    id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
+    username = Column(String(50), unique=True, nullable=False, index=True)
+    email = Column(String, unique=True, nullable=True)
+    hashed_password = Column(String, nullable=False)
+    role = Column(String, nullable=False, default='user')  # 'admin' | 'user'
+    is_active = Column(Boolean, default=True)
+    created_at = Column(DateTime, server_default=func.now())
+
+    # Absolute path to this user's photo directory (e.g., "/photos/daniel")
+    media_path = Column(String, nullable=False)