docs: README/SPEC current — multi-user, CLI accounts, Secure cookie, tests

- README: per-user history (was shared history.json), proxy/HTTPS
  access note, ANIWEB_SECURE, layout lists users.py + tests/ +
  login.html; merged duplicate history bullets
- SPEC: session hardening (Secure flag, per-request account
  existence check), run steps include account creation + test suite,
  milestone 7 (auth), fixed corrupted out-of-scope tail

SPEC.md

@@ -66,6 +66,10 @@ Two moving parts, no database, no framework on the frontend.
   (`python -m server.users add|rm|list`) — no self-signup. One-time
   migration: legacy single-password `credentials.json` → user
   `admin`; `history.json` → `history/admin.json`.
+- Session hardening: cookies are `HttpOnly`, `SameSite=Lax`, and
+  `Secure` when `ANIWEB_SECURE=1` (set by `run.sh`); the middleware
+  re-verifies the account still exists per request, so deleted
+  accounts' cookies are rejected immediately.
 - `GET /api/me`, `POST /account/delete` → current user / self-delete
   (account + history file).
 
@@ -91,17 +95,19 @@ Flow: search box → results grid (poster + title, click) → detail view
 
 ```sh
 uv venv .venv && uv pip install --python .venv/bin/python -r requirements.txt
-./run.sh            # launch/restart, logs to server.log
+.venv/bin/python -m server.users add <you>   # one-time account creation
+./run.sh            # launch/restart, logs to server.log, sets ANIWEB_SECURE=1
 ```
 
-Open `http://localhost:8321` (bound to 0.0.0.0 for LAN access).
+Use the app through your HTTPS proxy (with `Secure` cookies, plain
+remote HTTP can't hold a session). `python tests/run.py` runs the
+full suite against a throwaway server on :8399.
 
 ## Out of scope (v1)
 
 Downloads (`-d`), next-episode countdown (`-N`), syncplay, intro skip,
 ani-schedule integration, episode titles (not in anidb's API — needs
 a MyAnimeList API key). Add when someone asks.
-anidb's API — needs a MyAnimeList API key). Add when someone asks.
 
 ## Risks
 
@@ -122,3 +128,5 @@ anidb's API — needs a MyAnimeList API key). Add when someone asks.
 5. UI — search → detail → episodes → player.
 6. Polish — history with position + resume, sub/dub toggle, error
    states, autoplay default, `run.sh`.
+7. Auth — login screen, then multi-user CLI-created accounts with
+   per-user history + test suite.