docs: README/SPEC current — multi-user, CLI accounts, Secure cookie, tests

- README: per-user history (was shared history.json), proxy/HTTPS
  access note, ANIWEB_SECURE, layout lists users.py + tests/ +
  login.html; merged duplicate history bullets
- SPEC: session hardening (Secure flag, per-request account
  existence check), run steps include account creation + test suite,
  milestone 7 (auth), fixed corrupted out-of-scope tail

README.md

@@ -12,10 +12,13 @@ uv pip install --python .venv/bin/python -r requirements.txt
 ./run.sh
 ```
 
-Open <http://localhost:8321>. `run.sh` restarts cleanly if the server
-is already running; logs go to `server.log`. The server refuses to
-start without at least one user (a legacy `credentials.json`
-password, if any, is migrated to user `admin`).
+Open it through your HTTPS proxy (or <http://localhost:8321> from the
+host itself — browsers treat localhost as trusted). `run.sh` restarts
+cleanly if the server is already running; logs go to `server.log`.
+With `ANIWEB_SECURE=1` (set by `run.sh`), the session cookie is
+`Secure`, so remote plain-HTTP access can't hold a session — only the
+HTTPS proxy works. A legacy `credentials.json` password, if any,
+is migrated to user `admin` on first start.
 
 Account management (no self-signup by design):
 
@@ -36,24 +39,25 @@ the app or CLI are rejected immediately, even with an old cookie.
 - Per-user accounts (CLI-created, no self-signup): 30-day signed
   session cookie, 5 wrong attempts → 15-min lockout per user.
   PBKDF2-SHA256 hashes in `server/data/users.json` (0600).
-- Per-user watch history (`server/data/history/<user>.json`);
-  in-header chip with logout + delete-account.
+- Per-user watch history (`server/data/history/<user>.json`): position
+  saved every ~10s, resume where you left off, top-5 "recently played"
+  on the home page. Nothing stored in the browser — new devices pick
+  up your watch state after login, isolated per account.
+  In-header chip shows the user, with logout + delete-account.
 - Search with poster grid, detail view with synopsis + season tabs
 - HLS playback (vendored hls.js), browser ABR across 1080/720/360p
 - Dub/sub toggle
 - Autoplays the first episode (or resumes the last watched one); if the
   browser blocks autoplay, a "click to play" overlay appears
-- Server-persisted watch history (`server/data/history.json`): watch
-  position saved every ~10s, resume where you left off, top-5 "recently
-  played" on the home page — shared across browsers and devices
 
 ## Layout
 
 ```
-server/   FastAPI app (app.py) + anidb.app fetchers (upstream.py)
-          upstream.py is the ONLY Cloudflare-facing code
-static/   front-end: index.html, app.js, style.css, hls.min.js (vendored)
-run.sh    launch/restart the server
+server/   FastAPI app (app.py), anidb.app fetchers (upstream.py),
+          accounts (users.py). upstream.py is the ONLY Cloudflare-facing code
+static/   front-end: index.html, login.html, app.js, style.css, hls.min.js (vendored)
+tests/    test suite (run.py orchestrator, HTTP + browser tests)
+run.sh    launch/restart the server (sets ANIWEB_SECURE=1)
 SPEC.md   design + the verified anidb.app data flow
 ```