# 2026-08-07 — Username-based login + first-time admin setup + Gitea push

## Summary
Changed the account model to **username-based login** (was email-as-id), added mandatory
first-time admin setup (set email + change password), pushed the repo to Gitea.

## Changes
1. **User id = username** (was email). Email is now a separate optional field with uniqueness.
   - `UserStore.create_user(username, email=None, ...)`; login via username; JWT `sub` = username.
   - Admin user-creation uses `username` (email fallback kept for compatibility).
2. **Default admin**: `admin` / `1234`, with `must_setup=True`.
3. **Forced first-time setup**: after login with the default creds, the frontend router guards
   and sends the user to `/setup` — set email + new password (+ confirm), then `must_setup` clears.
   - Backend: new `POST /api/auth/setup` (`complete_setup` sets email + password, clears flag).
   - Login response now includes `must_setup`; `me` includes it too.
   - Frontend: `Login.vue` uses username, `Setup.vue` (new), router guard, `auth.finishSetup`.
4. **Docs**: README + HANDOFF + build-out log updated to `admin`/`1234` + setup flow.

## Verification
- Added `test_setup.py` (admin/1234 → must_setup → set email+password → old pw invalid, new pw
  works, admin can use app). ALL PASS.
- Adapted m0/m1/routes/security/e2e to username creds. **All 6 suites PASS.**
- Frontend `npm run build` ok. Live server: `admin`/`1234` login returns `must_setup=true`,
  SPA served at `http://localhost:5001`.

## Push
- Remote added: `origin` = https://git.moreminimore.com/kunthawat/sales-trainer.git
  (GITEA_TOKEN via env, not committed). Pushed `main` → `eadf4f7..e8a95bf`.

## Next (needs user for live model, no blocker here)
- Set `LLM_API_KEY` (+ provider) to enable analyze/persona/chat live path.
- Validate Docker build on EasyPanel.