- таблица mcp_tokens: sha256-хэш (unique) + хвост-хинт, снейпшот roles
  владельца на момент выпуска; миграции users.system_role/users.blocked
- выдача только из cookie-сессии: GET/POST /me/mcp_tokens (plaintext
  ровно один раз, ≥10 активных → 409), ревок вместо архива; админ-роуты
  для всех ключей; rate-limit на выдачу (5 за 10 мин)
- гард /mcp — require_mcp: Bearer mcp_* | статический GHARD_ADMIN_TOKEN |
  cookie; отозванный/заблокированный — тот же 401 (причина не раскрывается)
- вебхуки user.blocked/deleted/archived → users.blocked=1 + ревок ключей
  владельца; разблокировка — при следующем успешном логине; SSO-логаут
  ключи не трогает

Language comes from the gnexus-auth account profile by default; Settings
now hosts a per-service override that survives logouts and profile-webhook
syncs (users table keeps profile JSON verbatim, override in a separate
column that the upsert never touches). Open mode stores the choice in
localStorage.

- backend: users table (zero-migration, IF NOT EXISTS), app/locales.py
  (normalize_locale/effective_locale), users upsert on session create and
  user.updated webhook, GET /me returns locale + locale_effective,
  new PATCH /api/v1/me (cookie-session only; 'auto'/'""' clears override)
- frontend: hand-rolled i18n mirror of gnexus-creds (locale ref, t() with
  Slavic plurals, EN fallback), full dictionaries (~130 strings), <html
  lang> + <title> tracked via watch; SettingsPage with language picker
  (Auto/en/uk/ru); ServerCard/ServerPage/StoragePage status triple and
  table columns unified into reactive computed t() lookups; fmtAgo/
  fmtUptime localized; nav/login/shell translated; default html lang en

Co-Authored-By: Claude Code <noreply@anthropic.com>

verify_and_parse_webhook exists only on GAuthClient; the route holds
HmacWebhookVerifier + JsonWebhookParser directly, so call verify() and
parse() separately (signature itself was always fine — the AttributeError
landed in the 401 bucket).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Auth off by default (client_id empty). When GHARD_AUTH_CLIENT_ID is set,
the web UI gets a creds-style sign-in gate: splash -> /me -> login screen
(OAuth starts from the click, not page load). Sessions and OAuth state
live in SQLite (survive restarts); webhook endpoint applies global_logout/
profile updates. Scripts/MCP keep working with the Bearer token, agents
keep X-Server-Key ingest. Includes compose env passthrough, README guide.

Co-Authored-By: Claude Code <noreply@anthropic.com>