feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

app/api/auth.py

@@ -0,0 +1,63 @@
+"""Auth API — single-admin sign-in (phase 16; A10 revised 2026-08-22).
+
+* ``POST /api/login``   — 204 + signed session cookie on success; 401
+  ``invalid password`` on any mismatch (constant-time, one generic
+  message, no session set).
+* ``POST /api/logout``  — 204; clears the session and expires the cookie
+  (idempotent for anonymous callers).
+* ``GET  /api/whoami``  — ``{"authenticated": bool, "role":
+  "admin"|"anonymous"}``; the single source of truth for all UI gating.
+
+The public API otherwise stays stateless (A10): chat, the document
+content endpoint (soft rule — anonymous may open any document by direct
+URL), suggestions, and health never require the cookie.
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException, Request, Response
+
+from app.config import get_settings
+from app.core.auth import ADMIN_SESSION_KEY, check_password, sign_in, sign_out
+from app.schemas import LoginRequest, WhoamiResponse
+
+router = APIRouter(tags=["auth"])
+
+
+@router.post("/login", status_code=204)
+def login(payload: LoginRequest, request: Request) -> Response:
+    """Sign in the single admin.
+
+    Success: 204 + the signed ``bor_session`` cookie (``same_site=lax``,
+    12 h default lifetime). Failure: one generic 401 — the admin count is
+    one, so there is nothing else to leak, and a wrong password must not
+    set any session state.
+    """
+    settings = get_settings()
+    if check_password(payload.password, settings.admin_password):
+        sign_in(request.session)
+        return Response(status_code=204)
+    raise HTTPException(status_code=401, detail="invalid password")
+
+
+@router.post("/logout", status_code=204)
+def logout(request: Request, response: Response) -> Response:
+    """Sign out: clear the session AND expire the browser cookie.
+
+    ``sign_out`` empties the session dict (which the middleware does not
+    re-persist — an empty session has nothing to sign), so this route also
+    sends ``delete_cookie`` to make the browser drop the signed cookie
+    right now. Idempotent: an anonymous logout is still a 204.
+    """
+    sign_out(request.session)
+    response.delete_cookie(get_settings().session_cookie, path="/")
+    return Response(status_code=204)
+
+
+@router.get("/whoami", response_model=WhoamiResponse)
+def whoami(request: Request) -> WhoamiResponse:
+    """Who is the caller? Drives every UI gating decision (phase 16)."""
+    authenticated = bool(request.session.get(ADMIN_SESSION_KEY))
+    return WhoamiResponse(
+        authenticated=authenticated,
+        role="admin" if authenticated else "anonymous",
+    )