Several changes merged today were not reflected in the README. Bring it
back in sync with main:
- Security section: rewrite into Session/authorization, Login hardening,
Uploads/input, and Platform groups — documents DB re-validation of the
JWT per request (#12), role-based authorization (#10), optional TOTP
2FA (#9), login throttling + per-IP backoff, honeypot, bot-scoring/IP
ban, and mimetype-derived upload extensions (#11) + username
uniqueness checks on update (#13).
- Environment variables: add TRUST_PROXY, DEBUG_TRUST_PROXY, TOTP_ISSUER,
TOTP_CHALLENGE_TTL, and UPLOAD_DIR.
- Routes/API tables: add /admin/account and the account/totp endpoints
plus the login/totp second-factor step.
- Tech stack + project structure: note TOTP (speakeasy/qrcode), the
loginProtection/botScore middleware, the totp util, and the Account view.
Docs-only; no code changes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
