1## Why23Tally currently trusts a shared API token per team, so we cannot tell members apart, audit who changed what, or restrict exports to owners. Individual accounts are a prerequisite for assignment, notifications, and per-user permissions on the Q3 roadmap.45## What Changes67- Add email + password accounts with argon2id password hashing8- Add cookie-based sessions with an inactivity timeout and an optional "remember me" extension9- Lock accounts temporarily after repeated failed logins10- **BREAKING**: Retire the shared team API token; existing integrations must switch to personal access tokens (tracked separately)1112## Capabilities1314### New Capabilities15- `user-auth`: Account login, session lifecycle, and brute-force protection1617### Modified Capabilities18<!-- None: task-management already assumes an authenticated member -->1920## Impact2122- New `users` and `sessions` tables (migrations 0031-0033)23- `api/middleware/auth.go` replaced; every handler now receives a `*User`24- Web UI gains login/logout pages25- Shared team token removed from `config/tally.toml`