Update README for multi-user auth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -8,11 +8,12 @@ Sproutly takes the guesswork out of seed starting. Enter your plant varieties on
 
 ## Features
 
+- **Multi-user** — each user has their own account with fully isolated data
 - **Dashboard** — at-a-glance view of overdue, today's, and upcoming tasks with a full year planting timeline
 - **Seed Library** — manage plant varieties with frost-relative timing, germination days, sun/water requirements
 - **Garden Tracker** — log growing batches and track status from `planned` → `germinating` → `seedling` → `potted up` → `hardening off` → `garden` → `harvested`
 - **Year Timeline** — visual calendar showing when each variety's stages fall across the year
-- **Ntfy Notifications** — daily summary push notifications to your phone, configurable time, topic, and authentication
+- **Ntfy Notifications** — per-user daily summary push notifications to your phone, configurable time, topic, and authentication
 - **Settings** — set your last frost date, fall frost date, location, timezone, and notification preferences
 
 ## Stack
@@ -22,6 +23,7 @@ Sproutly takes the guesswork out of seed starting. Enter your plant varieties on
 | Frontend  | Nginx (static HTML/CSS/JS SPA) |
 | Backend   | FastAPI (Python)        |
 | Database  | MySQL 8.0               |
+| Auth      | JWT (python-jose + bcrypt) |
 | Notifications | Ntfy            |
 | Runtime   | Docker Compose          |
 
@@ -36,27 +38,34 @@ Sproutly takes the guesswork out of seed starting. Enter your plant varieties on
 ```bash
 git clone https://git.chns.tech/CooperandGoodman/sproutly.git
 cd sproutly
-cp .env.example .env   # edit credentials if desired
+cp .env.example .env   # set a strong SECRET_KEY and DB credentials
 docker compose up --build -d
 ```
 
-Access the app at **http://localhost:8053**
+Access the app at **http://localhost:8053** — create an account to get started.
 
 ### First Steps
 
-1. Go to **Settings** and enter your last frost date — this anchors all planting schedule calculations
-2. Optionally configure an [ntfy](https://ntfy.sh) topic for push notifications — supports no auth, username/password, or API key/token
-3. Browse the pre-loaded **Seed Library** (12 common vegetables, herbs, and flowers included)
-4. Start logging batches in **My Garden** as you sow seeds
+1. Register an account on the login screen
+2. Go to **Settings** and enter your last frost date — this anchors all planting schedule calculations
+3. Optionally configure an [ntfy](https://ntfy.sh) topic for push notifications
+4. Add varieties to your **Seed Library** and start logging batches in **My Garden**
 
 ## Environment Variables
 
-Copy `.env` and adjust as needed:
+Copy `.env.example` to `.env` and fill in all values:
 
 ```env
 MYSQL_ROOT_PASSWORD=sproutly_root_secret
 MYSQL_USER=sproutly
 MYSQL_PASSWORD=sproutly_secret
+SECRET_KEY=your-secret-key-change-this
+```
+
+`SECRET_KEY` is used to sign JWT tokens. Generate a secure value with:
+
+```bash
+python3 -c "import secrets; print(secrets.token_hex(32))"
 ```
 
 ## Project Structure
@@ -66,13 +75,15 @@ sproutly/
 ├── docker-compose.yml
 ├── .env
 ├── mysql/
-│   └── init.sql          # Schema + sample seed varieties
+│   └── init.sql          # Schema (multi-user)
 ├── backend/              # FastAPI application
 │   ├── main.py
+│   ├── auth.py           # JWT + bcrypt utilities
 │   ├── models.py
 │   ├── schemas.py
 │   ├── database.py
 │   └── routers/
+│       ├── auth.py       # /auth/register, /auth/login, /auth/me
 │       ├── varieties.py
 │       ├── batches.py
 │       ├── dashboard.py
@@ -90,7 +101,12 @@ sproutly/
 
 The FastAPI backend is available at `/api/` and includes automatic docs at **http://localhost:8053/api/docs**
 
+All endpoints except `/auth/register` and `/auth/login` require a `Authorization: Bearer <token>` header.
+
 Key endpoints:
+- `POST /api/auth/register` — create account
+- `POST /api/auth/login` — get JWT token
+- `GET /api/auth/me` — current user info
 - `GET /api/dashboard/` — dashboard data, tasks, and timeline
 - `GET/POST/PUT/DELETE /api/varieties/` — seed variety management
 - `GET/POST/PUT/DELETE /api/batches/` — growing batch management