Add multi-user MAX authentication and tenant isolation

deploy/.env.example

@@ -5,11 +5,9 @@ QMAX_TLS_EMAIL=admin@kusoft.xyz
 # Generate with: openssl rand -base64 48
 QMAX_JWT_SECRET=change-me-to-a-long-random-secret-at-least-32-characters
 
-# Enter this once on the Android login screen to pair the device with your private bridge.
+# Optional registration code shared with people allowed to create a QMAX account.
+# Leave empty for open phone registration. MAX still verifies every phone with its own code.
 QMAX_PAIRING_CODE=change-me-pairing-code
-
-# Use the phone number linked to the MAX account used by PyMax.
-QMAX_MAX_PHONE_NUMBER=79000000000
 QMAX_CORS_ALLOWED_ORIGINS=
 
 # Optional Firebase Cloud Messaging. Mount the service account JSON into the API container

deploy/docker-compose.yml

@@ -13,7 +13,6 @@ services:
       QMax__ReleasesPath: /data/releases
       QMax__JwtSecret: ${QMAX_JWT_SECRET}
       QMax__PairingCode: ${QMAX_PAIRING_CODE}
-      QMax__MaxPhoneNumber: ${QMAX_MAX_PHONE_NUMBER}
       QMax__MaxMode: Worker
       QMax__MaxWorkerBaseUrl: http://qmax-pymax-worker:3002
       QMax__CorsAllowedOrigins: ${QMAX_CORS_ALLOWED_ORIGINS:-}
@@ -40,7 +39,6 @@ services:
     restart: unless-stopped
     environment:
       PORT: 3002
-      PYMAX_PHONE_NUMBER: ${QMAX_MAX_PHONE_NUMBER}
       PYMAX_SESSION_DIR: /data/pymax-session
       PYMAX_SEND_ROOTS: /qmax-data:/tmp
       PYMAX_CHAT_FETCH_LIMIT: ${QMAX_PYMAX_CHAT_FETCH_LIMIT:-350}

deploy/releases/android/latest.json

@@ -1,14 +1,14 @@
 {
     "slug":  "qmax",
     "name":  "QMAX",
-    "version":  "0.1.39",
-    "androidVersionCode":  40,
+    "version":  "0.1.54",
+    "androidVersionCode":  55,
     "channel":  "stable",
     "platform":  "android",
     "packageKind":  "apk",
-    "downloadPath":  "/api/app-updates/android/download/qmax-0.1.39-stable.apk",
-    "packageSizeBytes":  17730369,
-    "sha256":  "fb1ba02daf4a5e99972794bd69965bef8219388c96344902b9d8a67ed2635803",
-    "notes":  "Chat composer now follows the Android keyboard height like Telegram, and downloaded video, audio, and document attachments keep correct local cache extensions.",
-    "publishedAt":  "2026-07-02T18:38:00.3130417Z"
-}
+    "downloadPath":  "/api/app-updates/android/download/qmax-0.1.54-stable.apk",
+    "packageSizeBytes":  17862069,
+    "sha256":  "69a65b8c8d00c16f2ece211f1e993b0a2da46776f8afa436db384fb818c2f147",
+    "notes":  "QMAX 0.1.54",
+    "publishedAt":  "2026-07-13T19:13:39.6141836Z"
+}