Phase 2 Step 4: Implement Authentication System

Implemented comprehensive Flask-Login authentication with single-user support.

New Features:
- Flask-Login integration with User model
- Bcrypt password hashing via PasswordManager
- Login, logout, and initial password setup routes
- @login_required and @api_auth_required decorators
- All API endpoints now require authentication
- Bootstrap 5 dark theme UI templates
- Dashboard with navigation
- Remember me and next parameter redirect support

Files Created (12):
- web/auth/__init__.py, models.py, decorators.py, routes.py
- web/routes/__init__.py, main.py
- web/templates/login.html, setup.html, dashboard.html, scans.html, scan_detail.html
- tests/test_authentication.py (30+ tests)

Files Modified (6):
- web/app.py: Added Flask-Login initialization and main routes
- web/api/scans.py: Protected all endpoints with @api_auth_required
- web/api/settings.py: Protected all endpoints with @api_auth_required
- web/api/schedules.py: Protected all endpoints with @api_auth_required
- web/api/alerts.py: Protected all endpoints with @api_auth_required
- tests/conftest.py: Added authentication test fixtures

Security:
- Session-based authentication for both web UI and API
- Secure password storage with bcrypt
- Protected routes redirect to login page
- Protected API endpoints return 401 Unauthorized
- Health check endpoints remain accessible for monitoring

Testing:
- User model authentication and properties
- Login success/failure flows
- Logout and session management
- Password setup workflow
- API endpoint authentication requirements
- Session persistence and remember me functionality
- Next parameter redirect behavior

Total: ~1,200 lines of code added

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

web/api/alerts.py

@@ -6,10 +6,13 @@ Handles endpoints for viewing alert history and managing alert rules.
 
 from flask import Blueprint, jsonify, request
 
+from web.auth.decorators import api_auth_required
+
 bp = Blueprint('alerts', __name__)
 
 
 @bp.route('', methods=['GET'])
+@api_auth_required
 def list_alerts():
     """
     List recent alerts.
@@ -36,6 +39,7 @@ def list_alerts():
 
 
 @bp.route('/rules', methods=['GET'])
+@api_auth_required
 def list_alert_rules():
     """
     List all alert rules.
@@ -51,6 +55,7 @@ def list_alert_rules():
 
 
 @bp.route('/rules', methods=['POST'])
+@api_auth_required
 def create_alert_rule():
     """
     Create a new alert rule.
@@ -76,6 +81,7 @@ def create_alert_rule():
 
 
 @bp.route('/rules/<int:rule_id>', methods=['PUT'])
+@api_auth_required
 def update_alert_rule(rule_id):
     """
     Update an existing alert rule.
@@ -103,6 +109,7 @@ def update_alert_rule(rule_id):
 
 
 @bp.route('/rules/<int:rule_id>', methods=['DELETE'])
+@api_auth_required
 def delete_alert_rule(rule_id):
     """
     Delete an alert rule.