users need always login

ARCHITECTURE.md

@@ -37,7 +37,7 @@ there is no browser-side persistence or independent playback state.
 flowchart TB
     Main[main.rkt<br/>configuration and lifecycle]
     Server[private/server.rkt<br/>HTTP adapter]
-    Users[private/users.rkt<br/>users, networks and sessions]
+    Users[private/users.rkt<br/>users, trusted proxies and sessions]
     Player[private/player.rkt<br/>application state and commands]
     Playlists[private/playlists.rkt<br/>durable playlist tabs]
     DLNAAdapter[private/dlna-playback.rkt<br/>playlist transition orchestration]
@@ -241,16 +241,19 @@ on every render.
 ### 3.7 User authentication
 
 Authentication is enabled by adding Argon2id password hashes under `[users]`.
-Requests whose effective client address belongs to a configured local network
-bypass login. A forwarded address is accepted only when the direct peer belongs
-to `[authentication] trusted-proxies`; the rightmost `X-Forwarded-For` value is
-used so an untrusted client cannot prepend a local address.
+All browser clients then authenticate, including clients on the local network.
+A forwarded address is accepted only when the direct peer belongs to
+`[authentication] trusted-proxies`; the rightmost `X-Forwarded-For` value is
+used so an untrusted client cannot prepend a forged address.
 
 Successful logins create opaque 256-bit session tokens. Only the token is sent
 to the browser in a `Secure`, `HttpOnly`, `SameSite=Strict` cookie; server-side
 session state has an idle timeout and is intentionally volatile. Login failures
-are rate-limited per effective client address. Agent endpoints are outside user
-sessions and retain their separate application-ID authorization.
+are rate-limited per effective client address. Authenticated requests move the
+server-side idle deadline. Once half the configured lifetime has elapsed, the
+cookie is reissued with a fresh lifetime; this avoids a `Set-Cookie` header on
+every one-second state poll. Agent endpoints are outside user sessions and
+retain their separate application-ID authorization.
 
 ## 4. Key runtime flows
 
@@ -334,7 +337,7 @@ file:
   setting remains supported);
 - allowed 256-bit playback-agent IDs under `[playback-agents]`;
 - the optional playlist-keystore override under `[player]`;
-- Argon2id user hashes, local networks, trusted proxies, and session timeout.
+- Argon2id user hashes, trusted proxies, and session timeout.
 
 Command-line network settings override INI values. Library paths from both
 sources are combined and de-duplicated.
@@ -345,13 +348,13 @@ and sessions still reset when the process restarts.
 
 ## 7. Security and operational boundaries
 
-The browser API has optional user authentication but no TLS termination or
-per-user player state. Authentication must be enabled before exposing it to an
-untrusted network, and a reverse proxy must provide HTTPS because session
-cookies are always marked `Secure`. Local-network bypass and forwarded client
-addresses are security-sensitive configuration: only known reverse-proxy peers
-may be trusted, and the application port should remain firewalled from the
-internet.
+The browser API has optional user authentication but no TLS termination.
+Authentication must be enabled before exposing it to an untrusted network, and
+a reverse proxy must provide HTTPS because session cookies are always marked
+`Secure`. Forwarded client addresses are security-sensitive configuration:
+only known reverse-proxy peers may be trusted, and the application port should
+remain firewalled from the internet. Playlists are isolated by username, while
+renderer selection and transport state remain shared.
 
 Playback-agent registration and polling are authorized against a default-deny
 INI allowlist. Media URLs additionally contain an opaque per-track token. The