# Local usability improvements

These changes are in this local clone and the portfolio source download. They have not been pushed to GitHub.

## Run

```sh
./run.sh
# Open http://127.0.0.1:8000/docs
```

The launcher creates `.venv` and installs `requirements.txt` on first use. Python 3.12 is the verified runtime. Override the interpreter with `PYTHON_BIN` or use a prepared environment through `PROJECT_PYTHON`.

## Changes

- Restored the missing registration endpoint.
- Restricted registration to the user role and validated bcrypt byte lengths.
- Scoped device identity to each user and reloaded permissions from the database on each request.
- Defaulted to localhost, stopped trusting arbitrary forwarded IP headers, and added configurable database location.

## Verification and scope

2 integration scenarios passed: registration/login, two users in one browser, admin escalation denial, immediate role revocation, deactivation, and UTF-8 password limits. Tests use a fresh temporary database. Existing databases need a migration for the old globally unique device fingerprint; they are not modified automatically. Set SECRET_KEY for stable tokens across restarts. This is a local prototype, not a production identity service.

## Run the regression tests

```sh
.venv/bin/python -m pip install -r requirements-dev.txt
.venv/bin/python -m pytest -q
```