Release v0.6.0

Add database-backed user management and password reset tooling.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -10,6 +10,7 @@ Multi-connection SSH client that runs in your browser with JWT authentication.
 - **SFTP File Manager**: Built-in file manager with upload/download capabilities
 - **Terminal emulator**: Uses xterm.js for a full terminal experience
 - **Connection management**: Sidebar with connection list, status indicators, and quick actions
+- **Version updates**: Displays the running version and checks for a newer stable release every 24 hours, caching the response in the browser
 - **Remote load monitoring**: Active SSH connections display the remote Linux 1/5/15-minute load average
 - **Session Recording**: Automatic recording of SSH sessions in asciinema format with playback and configurable retention
 - **Dark theme**: Modern dark UI design
@@ -27,22 +28,35 @@ docker-compose -f deployment/docker-compose.yml up -d --build
 
 Open http://localhost:8080 in your browser. The application is served via a Caddy reverse proxy.
 
-### 3. Login
+### 3. Create the Administrator
 
-Default credentials:
-- Username: `admin`
-- Password: `admin`
+On first start, create the administrator account in the browser. Use a password with at least 12 characters.
 
 ## Configuration
 
 ### Users
 
-Set users via environment variable in `deployment/docker-compose.yml`:
+On a fresh installation, open the application to create the first administrator.
+For an existing installation, users configured with `WEBSSH_USERS` are imported into the database once.
+The first imported user becomes an administrator, the remaining imported users have the `user` role, and
+each imported user must change their password at their next login. Remove `WEBSSH_USERS` after migration:
+future user accounts are stored in the database.
+
+To import legacy users via the environment variable in `deployment/docker-compose.yml`:
 ```yaml
 environment:
   - WEBSSH_USERS=user1:pass1,user2:pass2
 ```
 
+New passwords must contain at least 12 characters. Passwords are stored as salted PBKDF2-HMAC-SHA256 hashes.
+Administrators can create and delete accounts from **Manage Users**; new users must replace their temporary password at first login.
+
+To reset an account password from a running Docker container, run the command interactively:
+```bash
+docker exec -it webssh-backend password-reset
+```
+The tool asks for the username (or accepts it as `password-reset username`), prompts for the new password without echoing it, invalidates existing sessions for that account, and requires the user to change the temporary password at their next login.
+
 ### JWT Secret
 
 Set custom JWT secret:
@@ -203,7 +217,7 @@ Pre-built multi-arch images available:
 
 ```bash
 docker pull danaildr/webssh:latest
-docker pull danaildr/webssh:0.5.1
+docker pull danaildr/webssh:0.6.0
 ```
 
 Supported architectures: `linux/amd64`, `linux/arm64`, `linux/arm/v7`
@@ -211,7 +225,7 @@ Supported architectures: `linux/amd64`, `linux/arm64`, `linux/arm/v7`
 ## Security Notes
 
 - Always use HTTPS in production (configure reverse proxy with SSL)
-- Change default credentials
+- Create a strong administrator password during first-run setup
 - Set a strong JWT_SECRET
 - The backend uses `AutoAddPolicy()` for SSH host keys (testing only - change for production)
 - Token expiry: 8 hours