multi-user auth (CLI-created accounts), per-user history, test suite

- server/users.py replaces credentials.py: users.json (0600), PBKDF2,
  one-time migration of the legacy single password to user admin
  (history.json -> history/admin.json)
- accounts are CLI-managed only: python -m server.users add|rm|list
  (no self-signup on an internet-exposed app); /signup route removed,
  login page back to username + password
- per-user 30-day signed session cookie (payload carries the
  username), per-user lockout, GET /api/me, POST /account/delete
- per-user watch history: server/data/history/<user>.json; ANIWEB_DATA
  env override for the data dir
- header chip: logged-in user, logout, delete account
- tests/: throwaway-server suite (port 8399, temp data dir) — 9 HTTP
  tests + 2 Playwright browser tests (login UI, real video playback
  behind auth); runs via python tests/run.py

static/app.js

@@ -217,6 +217,19 @@ function showPlayOverlay(v) {
 
 // ---------- boot ----------
 (async () => {
+  try {
+    const me = await api("/api/me");
+    document.getElementById("me").textContent = "hi, " + me.user;
+    const lo = document.getElementById("logout");
+    lo.style.display = ""; lo.onclick = async () => {
+      await fetch("/logout", {method: "POST"}); location.href = "/login";
+    };
+    const da = document.getElementById("delacct");
+    da.style.display = ""; da.onclick = async () => {
+      if (!confirm("Delete your account and watch history?")) return;
+      await fetch("/account/delete", {method: "POST"}); location.href = "/login";
+    };
+  } catch { /* not logged in: api() already redirected to /login */ }
   await refreshHistory();
   const p = new URLSearchParams(location.search);
   try {