docs: update account flow (username admin/1234 + forced setup) in README/HANDOFF/engineering-log

docs/engineering-log/2026-08-07-auth-gitea.md

@@ -0,0 +1,32 @@
+# 2026-08-07 — Username-based login + first-time admin setup + Gitea push
+
+## Summary
+Changed the account model to **username-based login** (was email-as-id), added mandatory
+first-time admin setup (set email + change password), pushed the repo to Gitea.
+
+## Changes
+1. **User id = username** (was email). Email is now a separate optional field with uniqueness.
+   - `UserStore.create_user(username, email=None, ...)`; login via username; JWT `sub` = username.
+   - Admin user-creation uses `username` (email fallback kept for compatibility).
+2. **Default admin**: `admin` / `1234`, with `must_setup=True`.
+3. **Forced first-time setup**: after login with the default creds, the frontend router guards
+   and sends the user to `/setup` — set email + new password (+ confirm), then `must_setup` clears.
+   - Backend: new `POST /api/auth/setup` (`complete_setup` sets email + password, clears flag).
+   - Login response now includes `must_setup`; `me` includes it too.
+   - Frontend: `Login.vue` uses username, `Setup.vue` (new), router guard, `auth.finishSetup`.
+4. **Docs**: README + HANDOFF + build-out log updated to `admin`/`1234` + setup flow.
+
+## Verification
+- Added `test_setup.py` (admin/1234 → must_setup → set email+password → old pw invalid, new pw
+  works, admin can use app). ALL PASS.
+- Adapted m0/m1/routes/security/e2e to username creds. **All 6 suites PASS.**
+- Frontend `npm run build` ok. Live server: `admin`/`1234` login returns `must_setup=true`,
+  SPA served at `http://localhost:5001`.
+
+## Push
+- Remote added: `origin` = https://git.moreminimore.com/kunthawat/sales-trainer.git
+  (GITEA_TOKEN via env, not committed). Pushed `main` → `eadf4f7..e8a95bf`.
+
+## Next (needs user for live model, no blocker here)
+- Set `LLM_API_KEY` (+ provider) to enable analyze/persona/chat live path.
+- Validate Docker build on EasyPanel.