Unauthenticated visitors see the app with left/right ad columns (loaded
from ads-left.html and ads-right.html). Logged-in users see no ads and
get a logout link in the top bar.
Login is at /login (not linked). Users are managed in users.txt via
scripts/add_user.py (scrypt-hashed passwords). users.txt is gitignored.
New env vars: USERS_FILE, ADS_DIR.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
