Add multi-session auth and changelog tracking

AGENTS.md

@@ -0,0 +1,27 @@
+# AGENTS
+
+## Update Discipline
+
+- Every shipped feature change must be recorded in the in-app update log page at `/changelog`.
+- Every shipped feature change must also be recorded in [docs/CHANGELOG.md](/root/auto/tennis/docs/CHANGELOG.md).
+- When online smoke tests are run, record whether the public site is already serving the new build or still on an older asset revision.
+- Each update log entry must include:
+  - release date
+  - feature summary
+  - tested modules or commands
+  - corresponding repository version identifier
+    - prefer the git short commit hash
+- After implementation, run the relevant tests before pushing.
+- Only record an entry as shipped after the related tests pass.
+- When a feature is deployed successfully, append the update entry before or together with the repository submission so the changelog stays in sync with the codebase.
+
+## Session Policy
+
+- Username login must support multiple active sessions across multiple devices.
+- New logins must not invalidate prior valid sessions for the same user.
+- Session validation should be tolerant of older token payloads where optional display fields are absent.
+
+## Timezone Policy
+
+- User-facing time displays should use `Asia/Shanghai`.
+- Daily aggregation keys and schedule-related server calculations should also use `Asia/Shanghai`.