Add user management with admin and viewer roles

- data/users.json store; existing single account migrates to first admin
- Roles: admin (settings, import, users) and viewer (read-only, own password)
- Live role/disabled lookup; per-user session epoch so password changes,
  resets and disabling sign that user out everywhere
- Login brute-force lockout (5 fails -> 5 min), constant-time unknown-user check
- /api/users CRUD with last-admin and self-lockout safeguards
- Account page (own password + admin user management); role-aware header
- Min password length 8; recovery token resets the primary admin and clears lockouts

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/public/dashboard-setup.html

@@ -30,12 +30,12 @@ button:hover { opacity: 0.88; }
 <div class="card">
   <h1>Create Dashboard Account</h1>
   <p class="sub">First-time setup — create your admin account</p>
-  <div id="err" class="error" style="display:none">Password must be at least 6 characters.</div>
+  <div id="err" class="error" style="display:none">Username must be 3–32 letters, numbers, . _ - and the password at least 8 characters.</div>
   <form method="POST" action="/dashboard/setup">
     <label>Username</label>
-    <input name="username" type="text" autocomplete="username" autofocus required>
+    <input name="username" pattern="[A-Za-z0-9._\-]{3,32}" autocapitalize="none" type="text" autocomplete="username" autofocus required>
     <label>Password</label>
-    <input name="password" type="password" autocomplete="new-password" required minlength="6">
+    <input name="password" type="password" autocomplete="new-password" required minlength="8">
     <button type="submit">Create Account</button>
   </form>
   <p class="note">This account protects your station dashboard. Store these credentials somewhere safe.</p>