POST /setup honored the setup gate only on GET, so a passwordless
leftover account was claimable by an anonymous visitor once any other
user was credentialed. The POST branch now checks setup_required first,
and _ensure_default_user seeds the passwordless default user only when
no users exist at all — deleting user id 1 while other users survive no
longer resurrects a claimable account, while fresh installs and full
teardowns still re-seed default and reopen setup.

Registration verify now maps the UNIQUE-constraint sqlite3.IntegrityError
from a repeated credential id to the generic 400 instead of a 500, and
finish_registration stores transports only when the client JSON carries a
genuine list.

@@ -9,0 +10,4 @@
+[[allowlists]]
+description = "Canned WebAuthn test vectors copied verbatim from the public webauthn 3.0.1 sdist test suite; not secrets"
+paths = [
+    '''(?:^|/)tests/webauthn_fixtures\.py$''',

@@ -0,0 +53,4 @@
+            " VALUES (1, X'00', X'00', 0, 'Passkey again')"
+        )
+        raised = False
+    except Exception:

@@ -54,0 +86,4 @@
+```
+
+Answering anything but `y` or `yes` aborts with no changes. A deletion removes
+the account's subscriptions, aggregates, read state, settings, and passkeys;

@@ -9,0 +9,4 @@
+
+[[allowlists]]
+description = "Canned WebAuthn assertion vector copied verbatim from the public webauthn 3.0.1 sdist test suite; not a secret. Line-exact: any other finding in this file still trips."
+regexTarget = "line"

@@ -31,1 +31,4 @@
   keyboard shortcuts, next-unread navigation
+- **Passkeys** — optional WebAuthn sign-in with self-service enrollment and
+  credential management (passwords remain the fallback)
+- **Account management** — password change, self-service account deletion,

@@ -53,1 +53,4 @@
 
+### `create-user`
+
+Create a new account with a password.

@@ -0,0 +85,4 @@
+deleting a passkey in Yunjin does not remove the credential from the device's
+passkey provider; remove it there too if you no longer want it on the device.
+
+## Account deletion

@@ -0,0 +1,24 @@
+# Account management
+
+Your account is managed from **Settings → Account** in the web interface:
+that card holds password change, passkey enrollment and management (see

@@ -0,0 +10,4 @@
+
+Open **Settings → Account**, enter your current password and the new password
+twice, and save. Your current session stays signed in; every other signed-in
+device is signed out. If you have lost your password, an administrator on the

@@ -53,1 +53,4 @@
 
+### `create-user`
+
+Create a new account with a password. This is the only way to create an

@@ -0,0 +60,4 @@
+    # Flask rejects any session cookie older than PERMANENT_SESSION_LIFETIME
+    # (open_session max_age), so a literal 30-day offset needs a ceiling above
+    # it; only the guard's cap mechanism is under test here.
+    app.config["PERMANENT_SESSION_LIFETIME"] = timedelta(days=60)