added backends, improved templating, rbac

README.md

@@ -922,3 +922,28 @@ curl -X POST 'http://127.0.0.1:8000/api/v1/campaigns/<campaign-id>/versions/<ver
 ```
 
 Strict validation/build/send endpoints are unchanged. The WebUI should use partial validation while editing, and only call strict validation/build when the user reaches Review/Send.
+
+
+## Browser login / session auth
+
+The backend now supports both automation API keys and browser session tokens.
+
+Development login after `init_db --with-dev-data` or dev bootstrap:
+
+```text
+Tenant: default
+Email: admin@example.local
+Password: dev-admin
+```
+
+Login endpoint:
+
+```bash
+curl -X POST http://127.0.0.1:8000/api/v1/auth/login \
+  -H 'Content-Type: application/json' \
+  -d '{"tenant_slug":"default","email":"admin@example.local","password":"dev-admin"}'
+```
+
+Use the returned `access_token` as `Authorization: Bearer <token>`. Existing API keys still work via `X-API-Key`.
+
+RBAC scaffolding now includes users, groups, roles, direct user-role assignments, group-role assignments and login sessions. The development user receives the `owner` role.