Complete managed account lifecycle

docs/Architecture.md

@@ -925,9 +925,12 @@ main
 
 ### HTTP Frontend Auth
 
-- Optional token or HTTP Basic Auth middleware
-- Configured in `[frontends.http.auth]`
-- Rate limiting supported
+- Optional Argon2id-backed managed accounts with HttpOnly session cookies
+- Composable Read, Control, Write, and Administrator roles, with policy shared by middleware and handlers
+- Atomic JSON persistence with migration from the legacy single-role schema
+- Account enable/disable, administrator CRUD, self-service password changes, and session revocation on security changes
+- A database invariant always preserves at least one enabled administrator
+- Per-IP login rate limiting; configured in `[frontends.http.auth]`
 
 ### Transport Security
 

docs/UX_Guidelines.md

@@ -354,8 +354,11 @@ Routes are classified into three tiers:
 
 ### 7.3 User Management
 
-Only administrators can list, add, update, or remove accounts. The final
-administrator cannot be removed or demoted.
+Every authenticated account gets a Settings > Account tab for changing its own
+password. Only administrators get Settings > Users, where accounts can be
+created, enabled/disabled, assigned multiple roles, given a new password, or
+removed. The final enabled administrator cannot be disabled, removed, or
+demoted. Account security changes revoke every active session for that account.
 
 ---
 

docs/User-Manual.md

@@ -626,9 +626,11 @@ credentials in configuration before first startup on an exposed deployment.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
 - User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
 - Roles are independent; for example, an account may have Read and Write without Control.
-- Administrators can add/remove users and change roles/passwords in Settings > Users.
-- At least one administrator must always remain and cannot be removed or demoted.
-- Removing an account or changing its password/role revokes its sessions.
+- Every signed-in user can change their own password in Settings > Account. This signs out all of their sessions.
+- Administrators can add, enable/disable, or remove users and change roles/passwords in Settings > Users.
+- At least one enabled administrator must always remain and cannot be disabled, removed, or demoted.
+- Disabling/removing an account or changing its password/roles revokes all of its sessions.
+- Existing account files migrate automatically: legacy accounts are enabled by default and legacy `user`/`admin` roles become Read/all roles.
 
 ### Routes
 
@@ -637,8 +639,9 @@ credentials in configuration before first startup on an exposed deployment.
 | `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
 | `/auth/session` | GET | Check current session/roles |
+| `/auth/account/password` | PATCH | Change the signed-in user's password after verifying the current password |
 | `/auth/users` | GET/POST | List or add users (admin only) |
-| `/auth/users/{username}` | PATCH/DELETE | Change password/roles or remove user (administrator only) |
+| `/auth/users/{username}` | PATCH/DELETE | Change enabled state/password/roles or remove user (administrator only) |
 
 Read routes require Read. Radio mutations require Control. Logbook access and
 bookmark mutations require Write. Administrator grants every permission.