feat: cluster reliability (leader failover, crash rejoin, key exchange) + auth/users + canvas/forwards enhancements + comprehensive README + API docs

- Cluster: forwardToNext offline detection (leader+non-leader), WatchLeader 1s heartbeat fallback, 409 for standalone nodes, Node.NodeKey key exchange via token ring, ClusterPeers persistence + auto-rejoin, Forward delegates to forwardToNext (bugfix)
- Auth: Basic Auth (flag-creds fast path) + bcrypt users (admin/viewer) + Bearer API keys (read/write/admin scope)
- Frontend: UsersView (accounts+API keys), ClusterView (ring/nodeKey/tasks/topology/log), StatusView (group management, per-proxy status), CanvasView (edge toggle/group), PortEdge (disabled/group labels)
- API: handlers split (canvas/forwards/users/logs), canvas export/import, forwards group start/stop/assign/delete, cluster endpoints
- Docs: comprehensive README rewrite (all flags/APIs/auth/cluster), docs/cluster-api.md (cluster management API reference)
- Deploy: run-cluster.sh now 4-node ring + 1 isolated standalone, test-forward.sh updated for 4 nodes
- Removed plan.md (design notes consolidated into README + API docs)

web/src/auth.ts

@@ -0,0 +1,34 @@
+// Lightweight reactive auth principal for the SPA. The browser handles Basic
+// Auth (prompted once when the SPA shell loads behind auth("read")); this just
+// mirrors the resolved identity from GET /me so views can gate their UI.
+//
+// We default to read until /me resolves so a viewer never sees a flash of
+// admin controls. canWrite/isAdmin are memoized over the reactive level.
+import { computed, ref } from 'vue'
+import type { AccessLevel } from './types'
+import { api } from './api'
+
+export const authLevel = ref<AccessLevel>('read')
+export const authName = ref('')
+export const authReady = ref(false)
+
+const RANK: Record<AccessLevel, number> = { read: 1, write: 2, admin: 3 }
+
+export const canWrite = computed(() => RANK[authLevel.value] >= RANK.write)
+export const isAdmin = computed(() => authLevel.value === 'admin')
+
+// fetchMe resolves the current principal. Called once on app mount; safe to
+// call again after account changes that could affect the live session.
+export async function fetchMe(): Promise<void> {
+  try {
+    const me = await api.me()
+    authLevel.value = me.level
+    authName.value = me.name
+  } catch {
+    // 401 (no/failed auth) — stay read-only; the browser will have prompted.
+    authLevel.value = 'read'
+    authName.value = ''
+  } finally {
+    authReady.value = true
+  }
+}