v4.7 新增账号系统，云端存储保证计算的长久有效

README.md

@@ -12,7 +12,9 @@ Open `http://127.0.0.1:18765`.
 
 ## Reverse Proxy
 
-The service listens on port `18765`. You can later reverse proxy `np.lihato.icu` to this port from your public server.
+The service listens on port `18765`. The current local deployment is reverse proxied as `npt.lihato.icu`.
+
+Traefik only performs TLS termination, compression, and reverse proxying for `npt`; authentication is enforced by this application.
 
 ## Endpoints
 
@@ -26,7 +28,7 @@ The service listens on port `18765`. You can later reverse proxy `np.lihato.icu`
 
 ## Persistent Shares
 
-Shared result links are stored in Redis when `NP_REDIS_URL` is enabled. The compose file maps Redis data to `./runtime/redis` and enables AOF/RDB persistence, so shares survive container recreation and service restarts. Back up or migrate `./runtime/redis` if you move the deployment.
+Live jobs and sessions are stored in Redis when `NP_REDIS_URL` is enabled. Account history and share links are stored in `./runtime/account/np-replica.sqlite3`; back up both runtime directories when moving the deployment.
 
 ## Notes
 
@@ -35,7 +37,7 @@ Shared result links are stored in Redis when `NP_REDIS_URL` is enabled. The comp
 - Pair matrices are returned as a preview block to keep responses manageable.
 - The Docker image compiles ViennaRNA `RNAplot` from `rna/ViennaRNA-2.7.2.tar.gz` and embeds SVG structure plots into MFE results.
 - Multistrand MFE plots now use a split-strand layout by default when a structure contains `+`, with `RNAplot` retained as the fallback path.
-- The web UI now supports Chinese and English switching, browser-side history, result export, and async polling for submitted jobs.
+- The web UI supports Chinese and English switching, account-scoped cloud history, result export, share controls, and async polling for submitted jobs.
 - Docker now starts three services: `np-replica`, `np-worker`, and `redis`.
 - Async jobs use Redis-backed storage and queueing when `NP_REDIS_URL` is configured; otherwise the app falls back to the older in-memory mode.
 - The browser-facing API and page behavior stay the same after enabling Redis-backed jobs.
@@ -45,6 +47,11 @@ Shared result links are stored in Redis when `NP_REDIS_URL` is enabled. The comp
 - Static pages are served with ETag-based browser caching; JSON API responses remain uncached.
 - The force-directed structure viewer lazy-loads D3 only when that view is opened, so the initial page load is not blocked by the external CDN.
 - `/health` uses Redis queue length plus a running-job set instead of scanning every historical job on each poll.
+- Application login uses the public Authentik issuer at `https://auth.lihato.icu/` with Authorization Code + PKCE.
+- The current `npt` instance uses issuer `/application/o/nupack-account-npt/`, client `npt-replica-web`, callback `https://npt.lihato.icu/auth/callback`, and logout return `https://npt.lihato.icu/`.
+- For the independent `np` deployment on `100.64.0.11`, set `NP_OIDC_ISSUER=https://auth.lihato.icu/application/o/nupack-account/`, `NP_OIDC_CLIENT_ID=np-replica-web`, `NP_OIDC_REDIRECT_URI=https://np.lihato.icu/auth/callback`, and `NP_OIDC_POST_LOGOUT_URI=https://np.lihato.icu/`.
+- Redis stores the live queue and login sessions. SQLite WAL at `/data/np-replica.sqlite3` stores users, owned jobs, compressed inputs/results/errors, usage totals, and durable share links.
+- History and job APIs enforce ownership by the Authentik OIDC subject. Public share links expose only the selected record and can be disabled or given an expiry by its owner.
 
 
 
@@ -53,7 +60,8 @@ Shared result links are stored in Redis when `NP_REDIS_URL` is enabled. The comp
   - 最多同时跑 16 个任务
   - 每个任务最多用 4 个计算线程
   - 后续任务进入队列等待
-  - 理论上最多占用约 64 个 native 计算线程，避免 16 × 8 这类过度超卖
+  - 每个任务的 NUPACK 缓存上限为 8 GB
+  - 理论上最多占用约 64 个 native 计算线程
 
   如果后面你发现机器还会被压满，最直接的调法就是在 docker-compose.yml 里继续压：