Accounts with limits: a Newznab key and a tier per user, daily API and NZB counts, invites

ACCESS=accounts (config/access.ts; open stays the default and behaves as
before): Newznab and the catalog's releases routes name a user (apikey or
the web interface's token), whose tier sets searches and NZBs per UTC day
(Newznab 500/501, the catalog 429) and how far back they see (102/403).
Counted in one upsert per use, so the last one can't be taken twice;
caps, stats and refused requests aren't counted. Signup takes an invite
(SIGNUP), which may give a tier; ace access:invite, access:tier (extends a
running tier), access:suspend. The web interface signs in and shows the
day's usage and the Newznab key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

start/env.ts

@@ -52,6 +52,10 @@ export default await Env.create(new URL('../', import.meta.url), {
   // Newznab API key (empty: no key needed)
   NEWZNAB_API_KEY: Env.schema.secret.optional(),
 
+  // Access (config/access.ts): open (one key, no limits) or accounts (a key per user, tiers with daily limits)
+  ACCESS: Env.schema.enum.optional(['open', 'accounts'] as const),
+  SIGNUP: Env.schema.enum.optional(['open', 'invite', 'closed'] as const),
+
   // Coordinator
   RANGE_ARTICLES: Env.schema.number.optional(),
   TAIL_EVERY_SECONDS: Env.schema.number.optional(),

start/routes.ts

@@ -45,13 +45,18 @@ router
       router
         .group(() => {
           router.get('profile', [controllers.Profile, 'show'])
+          router.post('api-key', [controllers.Profile, 'resetApiKey'])
           router.post('logout', [controllers.AccessTokens, 'destroy'])
         })
         .prefix('account')
         .as('profile')
         .use(middleware.auth())
 
-      // The catalog (REBUILD.md, part 9): open, as voyager 1's (the web interface uses it); Newznab has its key.
+      // How the web interface signs in: open, or accounts with limits (config/access.ts).
+      router.get('access', [controllers.Releases, 'access'])
+
+      // The catalog (REBUILD.md, part 9): open, as voyager 1's (the web interface uses it), unless ACCESS
+      // is `accounts`: then a user's token or apikey, counted as Newznab's are (AccessService).
       router.get('releases', [controllers.Releases, 'index'])
       router.get('releases/:id', [controllers.Releases, 'show']).where('id', router.matchers.number())
       router.get('releases/:id/nzb', [controllers.Releases, 'nzb']).where('id', router.matchers.number())