Web users had no persistent fingerprint, losing codex/achievements/
rankings on reconnect. Now web users enter nickname + password:
- New accounts: set password (min 4 chars, bcrypt hashed)
- Existing accounts: verify password to log in
- On success: deterministic fingerprint SHA256(web:nickname) assigned
- SSH users with real key fingerprints skip password entirely
New files: store/passwords.go, store/passwords_test.go
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tolelom
d44bba5364