Add multi-user auth, admin panel, and timezone support; rename to Yolkbook

- Rename app from Eggtracker to Yolkbook throughout
- Add JWT-based authentication (python-jose, passlib/bcrypt)
- Add users table; all data tables gain user_id FK for full data isolation
- Super admin credentials sourced from ADMIN_USERNAME/ADMIN_PASSWORD env vars,
  synced on every startup; orphaned rows auto-assigned to admin post-migration
- Login page with self-registration; JWT stored in localStorage (30-day expiry)
- Admin panel (/admin): list users, reset passwords, disable/enable, delete,
  and impersonate (Login As) with Return to Admin banner
- Settings modal (gear icon in nav): timezone selector and change password
- Timezone stored per-user; stats date windows computed in user's timezone;
  date input setToday() respects user timezone via Intl API
- migrate_v2.sql for existing single-user installs
- Auto-migration adds timezone column to users on startup
- Updated README with full setup, auth, admin, and migration docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/routers/flock.py

@@ -5,30 +5,49 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from database import get_db
-from models import FlockHistory
+from models import FlockHistory, User
 from schemas import FlockHistoryCreate, FlockHistoryUpdate, FlockHistoryOut
+from auth import get_current_user
 
 router = APIRouter(prefix="/api/flock", tags=["flock"])
 
 
 @router.get("", response_model=list[FlockHistoryOut])
-def list_flock_history(db: Session = Depends(get_db)):
-    q = select(FlockHistory).order_by(FlockHistory.date.desc())
+def list_flock_history(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    q = (
+        select(FlockHistory)
+        .where(FlockHistory.user_id == current_user.id)
+        .order_by(FlockHistory.date.desc())
+    )
     return db.scalars(q).all()
 
 
 @router.get("/current", response_model=Optional[FlockHistoryOut])
-def get_current_flock(db: Session = Depends(get_db)):
-    """Returns the most recent flock entry — the current flock size."""
-    q = select(FlockHistory).order_by(FlockHistory.date.desc()).limit(1)
+def get_current_flock(
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    q = (
+        select(FlockHistory)
+        .where(FlockHistory.user_id == current_user.id)
+        .order_by(FlockHistory.date.desc())
+        .limit(1)
+    )
     return db.scalars(q).first()
 
 
 @router.get("/at/{target_date}", response_model=Optional[FlockHistoryOut])
-def get_flock_at_date(target_date: date, db: Session = Depends(get_db)):
-    """Returns the flock size that was in effect on a given date."""
+def get_flock_at_date(
+    target_date: date,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
     q = (
         select(FlockHistory)
+        .where(FlockHistory.user_id == current_user.id)
         .where(FlockHistory.date <= target_date)
         .order_by(FlockHistory.date.desc())
         .limit(1)
@@ -37,8 +56,12 @@ def get_flock_at_date(target_date: date, db: Session = Depends(get_db)):
 
 
 @router.post("", response_model=FlockHistoryOut, status_code=201)
-def create_flock_entry(body: FlockHistoryCreate, db: Session = Depends(get_db)):
-    record = FlockHistory(**body.model_dump())
+def create_flock_entry(
+    body: FlockHistoryCreate,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    record = FlockHistory(**body.model_dump(), user_id=current_user.id)
     db.add(record)
     db.commit()
     db.refresh(record)
@@ -50,8 +73,12 @@ def update_flock_entry(
     record_id: int,
     body: FlockHistoryUpdate,
     db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
 ):
-    record = db.get(FlockHistory, record_id)
+    record = db.scalars(
+        select(FlockHistory)
+        .where(FlockHistory.id == record_id, FlockHistory.user_id == current_user.id)
+    ).first()
     if not record:
         raise HTTPException(status_code=404, detail="Record not found")
     for field, value in body.model_dump(exclude_none=True).items():
@@ -62,8 +89,15 @@ def update_flock_entry(
 
 
 @router.delete("/{record_id}", status_code=204)
-def delete_flock_entry(record_id: int, db: Session = Depends(get_db)):
-    record = db.get(FlockHistory, record_id)
+def delete_flock_entry(
+    record_id: int,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    record = db.scalars(
+        select(FlockHistory)
+        .where(FlockHistory.id == record_id, FlockHistory.user_id == current_user.id)
+    ).first()
     if not record:
         raise HTTPException(status_code=404, detail="Record not found")
     db.delete(record)