Add SQLite web users, privileged account CLI and session editing claims

config/api.example.toml

@@ -3,6 +3,11 @@ workspace = "../service-data/service"
 host = "127.0.0.1"
 port = 8080
 
+[auth]
+session_seconds = 3600
+# Production Linux: root-owned file, read-only for the service group.
+# users_database = "/etc/viano-bug-analysis/users.sqlite3"
+
 [[projects]]
 id = "viano-core"
 type = "wow"
@@ -21,10 +26,10 @@ id = "wow-capture-worker"
 token_env = "VBA_INTAKE_TOKEN"
 projects = ["viano-core"]
 
-# Separate operator identity/token. Submission clients remain non-operators.
+# Optional privileged machine integration, not a human login.
 # [[clients]]
-# id = "human-operator"
+# id = "automation-operator"
 # token_env = "VBA_OPERATOR_TOKEN"
 # projects = ["viano-core"]
 # operator = true
-# tester = true
+# Human accounts are created only by the privileged create_user console command.