feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

.env.example

@@ -36,6 +36,14 @@ BOR_RRF_K=60                      # Reciprocal Rank Fusion damping constant
 # BOR_IMPORT_EXTENSIONS=md,markdown,txt,yaml,yml,json,py
 # BOR_SUGGESTIONS=["How is my Kubernetes cluster set up?"]   # JSON list of onboarding chips
 
+# --- Admin & sign-in (single-admin password login; BOTH required) ---
+# The app refuses to start while either is empty (names the missing
+# variable(s) — README "Admin & sign-in"). Generate the secret with:
+#   python -c 'import secrets;print(secrets.token_hex(32))'
+BOR_ADMIN_PASSWORD=
+BOR_SESSION_SECRET=
+# BOR_SESSION_MAX_AGE=43200           # signed-cookie lifetime, seconds (default 12 h, sliding)
+
 # --- Debugging (0/1 — 1 enables attach-on-demand debugpy on port 5678) ---
 DEBUGPY=0
 # DEBUGPY_PORT=5678