- overscroll-behavior moved from <body> to <html>: with html+body both overflow-x:hidden,
body is a scroll container and the rule blocked wheel scrolling from reaching the page
- sunTimes returned the neighbouring day's sunrise/sunset (julian-day rounding), so midday
looked like night; align results to the requested local day
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- data/users.json store; existing single account migrates to first admin
- Roles: admin (settings, import, users) and viewer (read-only, own password)
- Live role/disabled lookup; per-user session epoch so password changes,
resets and disabling sign that user out everywhere
- Login brute-force lockout (5 fails -> 5 min), constant-time unknown-user check
- /api/users CRUD with last-admin and self-lockout safeguards
- Account page (own password + admin user management); role-aware header
- Min password length 8; recovery token resets the primary admin and clears lockouts
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Nate EmmertandClaude Sonnet 5.5