The encryption key is PBKDF2-derived from the login password. Changing
the password without migrating the key would make all books undecryptable
on the next login.
- Add POST /books/<pk>/rekey/ endpoint to replace a book's ciphertexts
- Password change form is now JS-driven: before submitting to the server,
derives the old key, verifies it matches localStorage, derives the new
key, re-encrypts all books (data + meta) and their highlights/bookmarks,
updates localStorage, then submits the Django form
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1426c69a73