Phase 2 Step 4: Implement Authentication System

Implemented comprehensive Flask-Login authentication with single-user support.

New Features:
- Flask-Login integration with User model
- Bcrypt password hashing via PasswordManager
- Login, logout, and initial password setup routes
- @login_required and @api_auth_required decorators
- All API endpoints now require authentication
- Bootstrap 5 dark theme UI templates
- Dashboard with navigation
- Remember me and next parameter redirect support

Files Created (12):
- web/auth/__init__.py, models.py, decorators.py, routes.py
- web/routes/__init__.py, main.py
- web/templates/login.html, setup.html, dashboard.html, scans.html, scan_detail.html
- tests/test_authentication.py (30+ tests)

Files Modified (6):
- web/app.py: Added Flask-Login initialization and main routes
- web/api/scans.py: Protected all endpoints with @api_auth_required
- web/api/settings.py: Protected all endpoints with @api_auth_required
- web/api/schedules.py: Protected all endpoints with @api_auth_required
- web/api/alerts.py: Protected all endpoints with @api_auth_required
- tests/conftest.py: Added authentication test fixtures

Security:
- Session-based authentication for both web UI and API
- Secure password storage with bcrypt
- Protected routes redirect to login page
- Protected API endpoints return 401 Unauthorized
- Health check endpoints remain accessible for monitoring

Testing:
- User model authentication and properties
- Login success/failure flows
- Logout and session management
- Password setup workflow
- API endpoint authentication requirements
- Session persistence and remember me functionality
- Next parameter redirect behavior

Total: ~1,200 lines of code added

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

web/api/schedules.py

@@ -7,10 +7,13 @@ and manual triggering.
 
 from flask import Blueprint, jsonify, request
 
+from web.auth.decorators import api_auth_required
+
 bp = Blueprint('schedules', __name__)
 
 
 @bp.route('', methods=['GET'])
+@api_auth_required
 def list_schedules():
     """
     List all schedules.
@@ -26,6 +29,7 @@ def list_schedules():
 
 
 @bp.route('/<int:schedule_id>', methods=['GET'])
+@api_auth_required
 def get_schedule(schedule_id):
     """
     Get details for a specific schedule.
@@ -44,6 +48,7 @@ def get_schedule(schedule_id):
 
 
 @bp.route('', methods=['POST'])
+@api_auth_required
 def create_schedule():
     """
     Create a new schedule.
@@ -68,6 +73,7 @@ def create_schedule():
 
 
 @bp.route('/<int:schedule_id>', methods=['PUT'])
+@api_auth_required
 def update_schedule(schedule_id):
     """
     Update an existing schedule.
@@ -96,6 +102,7 @@ def update_schedule(schedule_id):
 
 
 @bp.route('/<int:schedule_id>', methods=['DELETE'])
+@api_auth_required
 def delete_schedule(schedule_id):
     """
     Delete a schedule.
@@ -115,6 +122,7 @@ def delete_schedule(schedule_id):
 
 
 @bp.route('/<int:schedule_id>/trigger', methods=['POST'])
+@api_auth_required
 def trigger_schedule(schedule_id):
     """
     Manually trigger a scheduled scan.