Make tokens revocable and move the refresh token out of localStorage (0.46.0)

F5 — A token was valid until it expired, full stop. Resetting a compromised
account's password changed nothing for whoever held its tokens (up to 30 days
for a refresh token), demoting or disabling an account only took effect once
the same clock ran out, and logout was purely client-side.

Every account now has a token_version, every token is minted carrying it, and
every request compares the two. Bumping it is the revoke switch, pulled on the
three changes that alter what an account may do: password, role, active flag.
"Sign out everywhere" in the user menu bumps your own. Plain "Sign out" only
drops the cookie, because signing out on your phone should not kill your
desktop session.

The refresh token left localStorage for an httpOnly cookie (SameSite=Lax,
scoped to /api/auth), and the access token is now held in memory only. A
successful XSS can still act inside the open page but can no longer walk off
with 30 days of access. The cookie is marked Secure only when the request
arrived over HTTPS — request.url.scheme is trustworthy since the F4 fix — so a
plain-HTTP homelab keeps working. Any refresh token an older build left in
localStorage is deleted on first load. Scripted clients that cannot hold a
cookie can still ask for it in the body with ?in_body=true.

F9 comes with it, as predicted: the WebSocket helpers read the role off the
live user instead of the token's claim. /ws/exec is root-equivalent on the
host, and a token minted while the account was an admin stayed syntactically
valid after a demotion.

The sharp edge was the migration, not the feature. _ensure_model_columns emits
ADD COLUMN without a DEFAULT, so SQLite would have filled token_version with
NULL on every existing install, every version check would have failed against
it, and the upgrade would have locked out every user everywhere. The helper now
renders NOT NULL DEFAULT <literal> for scalar defaults; test_schema_migration
builds a genuinely old-shaped user table and asserts the backfill. The version
comparison also tolerates NULL as 1, so a database migrated by some other route
still works.

Writing that test surfaced an undocumented precondition: _ensure_model_columns
does nothing unless `models` has been imported, since SQLModel.metadata is
empty until then. It holds in production because init_db imports first; now it
says so.

The authorization matrix did its job — adding two auth routes failed the suite
until both were classified, which is exactly the review moment it exists for.

30 new tests (698 total). Upgrading signs everyone out once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dk43rmEeRfYi5wsLDbmfyG

README.md

@@ -15,6 +15,35 @@ as intuitive as Dockge, as capable as Portainer for Compose workflows.
 > (Auto-update) + Phase 23 (Secrets & configs) + Phase 24 (Design System v2)
 > complete.
 
+## Upgrading to 0.46.0 — everyone is signed out once
+
+Sessions now hold their access token in memory and the refresh token in an
+httpOnly cookie, so **the upgrade signs everybody out exactly once**. Sign back
+in and it behaves as before, including staying signed in across restarts.
+
+What changed and why:
+
+- **Tokens can be revoked.** Each account carries a `token_version` that every
+  token is minted with and every request checks. Resetting a password, changing
+  a role or disabling an account now bumps it, which cuts off the tokens that
+  account already holds — previously a password reset was cosmetic and whoever
+  had the old refresh token kept full access for up to 30 days.
+- **The refresh token left `localStorage`.** It is an httpOnly cookie
+  (`SameSite=Lax`, scoped to `/api/auth`), so a successful XSS can act inside the
+  open page but cannot walk off with 30 days of access. The cookie is marked
+  `Secure` only when the request arrived over HTTPS, so a plain-HTTP homelab
+  keeps working. Any refresh token left in `localStorage` by an older build is
+  deleted on first load.
+- **"Sign out everywhere"** in the user menu revokes every token the account
+  holds, on every device. Plain "Sign out" only ends the session on that device.
+- **WebSockets re-check the database.** Log streams and the container terminal
+  read the role from the live user instead of the token's claim, so a demotion
+  or a disabled account takes effect immediately — the terminal is
+  root-equivalent on the host.
+
+Scripted clients that cannot hold a cookie can still get the refresh token in
+the response body with `?in_body=true` on login and refresh.
+
 ## Upgrading to 0.44.0 / 0.45.0 — two defaults changed
 
 0.44.0 closes a privilege-escalation hole and tightens two defaults. Both
@@ -49,7 +78,10 @@ it is what your saved destination credentials are encrypted with.
 - **File-first stacks** — every stack is a plain `compose.yaml` (+ optional `.env`)
   on disk. The DB only stores metadata; nothing is locked in.
 - **Auth** — JWT access/refresh tokens, bcrypt hashing, admin/user roles, and a
-  first-launch setup wizard that creates the initial admin account.
+  first-launch setup wizard that creates the initial admin account. The access
+  token is held in memory; the refresh token is an httpOnly cookie. Every token
+  carries the account's `token_version`, so a password reset, role change or
+  disable revokes the tokens that account already holds — on every device.
 - **Stack lifecycle** — create, edit, clone, delete, and `up / down / start /
   stop / restart / pull / update` via `docker compose`.
 - **Live status** — running / partial / stopped / error / updating, computed from
@@ -506,7 +538,7 @@ Same three commands the CI runs — `build-and-push` only starts once they pass.
 ```bash
 cd backend
 pip install -r requirements-dev.txt
-pytest                            # 670 tests, no Docker daemon needed
+pytest                            # 698 tests, no Docker daemon needed
 ruff check .
 cd ../frontend && npx tsc --noEmit -p tsconfig.json
 ```
@@ -525,6 +557,13 @@ adding it to `USER_READABLE` with a note on why it cannot return a credential.
 `tests/test_agent_authorization.py` does the same for the agent, where a single
 forgotten `Depends(verify_token)` would expose a whole host.
 
+`tests/test_token_revocation.py` covers the revoke switch — that each of the
+three authority changes kills the account's tokens, that a cosmetic re-save does
+not, and that the refresh cookie is httpOnly and not marked `Secure` over plain
+HTTP. `tests/test_schema_migration.py` builds a database with the *old* user
+table and asserts the added column is backfilled rather than left NULL, which is
+what would otherwise have signed out every user on every install.
+
 `tests/test_bundled_templates.py` covers the 83 shipped templates: each must
 parse, name an image per service, keep `.env.example` in sync with the variables
 compose actually reads, ship every file it bind-mounts, and never come with a
@@ -534,6 +573,7 @@ working default password.
 
 ```
 POST   /api/auth/setup | login | refresh        GET /api/auth/me | needs-setup
+POST   /api/auth/logout | logout-everywhere
 GET    /api/stacks                              POST /api/stacks
 GET    /api/stacks/{id}                          PUT /api/stacks/{id}   DELETE /api/stacks/{id}
 POST   /api/stacks/{id}/{start|stop|restart|pull|update|down|clone}