feat(server): token auth, registration, admin panel, email redesign, and security hardening

.github/workflows/server-test.yml

@@ -0,0 +1,47 @@
+name: Server Tests
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "server/**"
+  pull_request:
+    branches: [main]
+    paths:
+      - "server/**"
+
+jobs:
+  ServerTests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    env:
+      OS: ubuntu-latest
+      PYTHON: "3.12"
+
+    defaults:
+      run:
+        shell: bash -el {0}
+
+    steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1
+
+      - name: Checkout Repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Setup Python
+        uses: actions/setup-python@2f17f13ef37957a9bc7461aa1a61b211e3c1c3ae # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install Server and Test Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e "server/[test]"
+
+      - name: Run Server Tests (non-Docker)
+        run: |
+          python -m pytest server/tests/ -v \
+            -k "not Docker and not docker and not runner_image and not server_image and not test_server_image and not test_runner_image and not test_server_rejects and not test_server_reports and not running_gremlin"

.gitignore

@@ -139,3 +139,6 @@ src/REvoDesign/UI/Ui_REvoDesign.py
 .claude/worktrees/
 .claude/scheduled_tasks.lock
 .claude/settings.local.json
+users.sqlite3
+testerror.txt
+/server/server_state

.pre-commit-config.yaml

@@ -42,6 +42,13 @@ repos:
         language: script
         pass_filenames: false
 
+      - id: check-changelog-duplicates
+        name: Reject duplicate section headers in CHANGELOG.md
+        entry: python dev/tools/check_changelog_duplicates.py CHANGELOG.md
+        language: system
+        pass_filenames: false
+        files: ^CHANGELOG\.md$
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
     hooks:

CLAUDE.md

@@ -110,6 +110,7 @@ All Qt imports MUST go through `REvoDesign.Qt` — never import PyQt5 or PyQt6 d
 | `validate-ui-i18n` | Smoke-test runtime UI loading + i18n pipeline |
 | `reject-generated-main-ui` | Ensure `Ui_REvoDesign.py` is never re-introduced |
 | `check-qt-binding-imports` | Reject direct PyQt5/PyQt6 imports |
+| `check-changelog-duplicates` | Reject duplicate `### Section` headers within a version block in CHANGELOG.md |
 
 ### Key conventions
 

Makefile

@@ -48,7 +48,7 @@ help:
 	@echo "  reinstall              Reinstall after code changes"
 	@echo "  compile-ui             Compile UI to Python code"
 	@echo "  translate              Translate UI translation into binaries"
-	@echo "  prepare-test           Run pip to install pytest-related packages and server-test deps"
+	@echo "  prepare-test           Run pip to install pytest-related packages"
 	@echo "  test                   Run the UnitTest suite"
 	@echo "  all-test               Run all tests (firstly the parallel(also the fastest), secondly the serial(also the slower), finally the slowest) "
 	@echo "  fast-test              Run all fast tests (first order)"
@@ -121,7 +121,6 @@ translate:
 
 prepare-test:
 	python -m pip install pytest pytest-cov pytest-order pytest-dependency coverage -q --no-cache-dir
-	python -m pip install "celery[redis]==5.3.4" docker==7.1.0 Flask==3.1.3 Flask-HTTPAuth==4.8.1 SQLAlchemy==2.0.46 -q --no-cache-dir
 
 # unit test
 test:

dev/tools/check_changelog_duplicates.py

@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Check CHANGELOG.md for duplicate section headers within a version block.
+
+Usage:
+    python dev/tools/check_changelog_duplicates.py [CHANGELOG.md]
+
+Exit code: non-zero if duplicates found.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+VERSION_RE = re.compile(r"^##\s+\[")
+SECTION_RE = re.compile(r"^###\s+(.+)")
+
+
+def check_changelog(path: Path) -> list[str]:
+    """Return a list of duplicate-section errors. Empty list = clean."""
+    errors: list[str] = []
+    lines = path.read_text().splitlines()
+
+    current_version: str | None = None
+    sections: list[tuple[int, str]] = []  # (line_number, section_name) for current version
+
+    def flush() -> None:
+        """Check the accumulated sections for the current version block."""
+        nonlocal sections
+        if not sections:
+            return
+        counts = Counter(name for _, name in sections)
+        for name, count in counts.items():
+            if count > 1:
+                dupes = [ln for ln, sn in sections if sn == name]
+                errors.append(
+                    f"{path}:{dupes[0]}: section '### {name}' appears {count} times "
+                    f"under '{current_version}' (lines {', '.join(map(str, dupes))})"
+                )
+        sections = []
+
+    for i, line in enumerate(lines, start=1):
+        # Version header starts a new block
+        m = VERSION_RE.match(line)
+        if m:
+            flush()
+            current_version = line.strip()
+            continue
+
+        # Section header within a version block
+        m = SECTION_RE.match(line)
+        if m and current_version is not None:
+            sections.append((i, m.group(1).strip()))
+
+    flush()  # check the last version block
+    return errors
+
+
+def main() -> int:
+    path = Path(sys.argv[1]) if len(sys.argv) > 1 else Path("CHANGELOG.md")
+    if not path.exists():
+        print(f"File not found: {path}", file=sys.stderr)
+        return 1
+
+    errors = check_changelog(path)
+    if errors:
+        print(f"{len(errors)} duplicate section(s) found:\n", file=sys.stderr)
+        for e in errors:
+            print(f"  {e}", file=sys.stderr)
+        return 1
+
+    print("CHANGELOG.md: no duplicate sections.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())