[usermaneGermane]

Part of the task "rename everything: PassMan → SecretSpace" (design: DESIGN-RENAME.md, kept outside the repo).

Until now a server carried the project's old name inside. This gives everything the current one and lets the server hold accounts and vaults in the format SecretSpace 4 writes.

What changes

• Names: secretspace_server.py, secretspace_setup.py, secretspace-sync.service; /opt/secretspace, /etc/secretspace, /var/lib/secretspace; user secretspace; SECRETSPACE_* settings; X-SecretSpace-* headers; health name secretspace-sync.
• secretspace_setup.py migrate moves an install from before the rename: stops the old service, renames the user, moves the three folders, rewrites the settings, installs the new unit and starts it. --dry-run only shows; --undo goes back. Port, token and vaults are not changed.
• The old names are read, never written: old headers from older apps, old settings keys.
• Two formats side by side: an account is format 1 until its app sends its keyset in the new form; a converted account never goes back. A vault is stored in the new form only when every member's account is converted; after that it takes neither an old upload nor a member who has not updated. /health lists format-2.
• Version 2.1.0. README: new section Updating a server from before 2.1.0.

Proof

• 622 tests pass (69 new: formats, migrate, the old-name guard).
• Mutation check: 35 deliberate breaks, all caught.
• SecretSpace 3 and 2.x apps keep syncing with this server unchanged (their tests are untouched and pass).

After the merge

Tag v2.1.0, release the tarball. Production is yours: the README section has the four steps (migrate --dry-run first).

🤖 Generated with Claude Code

https://claude.ai/code/session_011ojnyXb6JY4UPVU4waZe1w