feature: every user manages their own account through /account.

README.md

@@ -525,6 +525,7 @@ curl http://10.0.0.4:17081/
 | `/config` | The configuration without its secret options, and what the router resolved and runs, as JSON; needs a token |
 | `/users` | The users of OpenVPN and road-warrior access; needs a token |
 | `/groups` | The groups of users; needs a token |
+| `/account` | The account of the signed-in user: its details, its password and its TOTP enrolment; needs a user's token |
 
 The status holds the state of `vpn-router-setup`, `slapd` and each PostgreSQL cluster unit
 (`postgresql@<version>-<cluster>`, or `postgresql` as `no cluster` without one), of `strongswan` when site-to-site or
@@ -545,16 +546,18 @@ curl http://10.0.0.4:7081/status
 
 ### Tokens and signing in
 
-`/config`, `/users` and `/groups` need a JWT in an `Authorization: Bearer` header, signed with
+`/config`, `/users`, `/groups` and `/account` need a JWT in an `Authorization: Bearer` header, signed with
 HS256 by the key the web service makes on its first run, `/etc/vpn-router/web.key` (root only).
 The key never leaves the router; while it does not exist these paths and `/auth` are not served
 (404). A missing, expired or wrongly signed token, or one of another algorithm, gets 401 with
 `WWW-Authenticate: Bearer`. There are two kinds of tokens:
 
-- an access token of `/auth` names a user in `sub` and is valid for 5 minutes; the user must
-  be a member of the group `admins`, otherwise the request gets 403;
+- an access token of `/auth` names a user in `sub` and is valid for 5 minutes; every user may
+  call `/account`, and for the other paths the user must be a member of the group `admins`,
+  otherwise the request gets 403;
 - a token of `vpn-router-token`, run as root on the router, has the claim `admin` and is valid
-  for the lifetime given, without a maximum. It may call everything, and only such a token may
+  for the lifetime given, without a maximum. It names no user, so `/account` refuses it with 403;
+  it may call everything else, and only such a token may
   change the group `admins`: create it, rename a group to it, change or remove it, add or take
   out its members, or remove a user who is a member of it.
 
@@ -639,6 +642,24 @@ curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
      http://10.0.0.4:7081/users
 ```
 
+### The /account API
+
+`/account` serves the user the access token names, whether or not the user is a member of
+`admins`, with the same module as `/users`:
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `GET /account` | | the user as `/users` shows it, and `"admin"`, whether the user is a member of `admins` |
+| `PUT /account/password` | `{"current_password", "current_code", "password"}` | the user |
+| `POST /account/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
+| `PUT /account/otp` | `{"current_password", "current_code", "secret", "code"}` | the user, once the code matches the secret |
+
+`current_code` is needed only for a user enrolled for TOTP. A wrong current password or code gets
+403 and counts as a failed login; slapd accepts each code once, so a code used to sign in is not
+accepted again, and a change right after signing in waits for the next code. A user enrols or
+replaces the enrolment; removing it is left to `/users` and `vpn-router-user`. Changing the
+password revokes the user's refresh tokens. Other failures are those of `/users`.
+
 ### The /groups API
 
 `/groups` manages groups with the same token and the same module as `/users`.