feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

app/config.py

@@ -79,6 +79,20 @@ class Settings(BaseSettings):
     hybrid_lexical_candidates: int = 30
     rrf_k: int = 60
 
+    # --- Admin & sign-in (phase 16; A10 revised 2026-08-22) ---
+    # Single-admin auth via a signed session cookie (Starlette
+    # SessionMiddleware — no new services, no DB tables). Both secrets are
+    # REQUIRED at startup: ``create_app()`` refuses to boot when either is
+    # empty (``app.core.auth.ensure_admin_configured``). The password is
+    # plaintext on purpose (homelab scope, owner decision 2026-08-22);
+    # the session secret signs the cookie (``secrets.token_hex(32)``).
+    admin_password: str = ""
+    session_secret: str = ""
+    #: Signed-cookie lifetime in seconds (default 12 h, refreshed on
+    #: session writes — sliding for an active admin).
+    session_max_age: int = 43_200
+    session_cookie: str = "bor_session"
+
     # --- Import scope (A9, revised 2026-08-21) ---
     # Comma-separated list of lowercased file extensions (no dot) imported
     # by ``scripts/import_docs.py``. Hidden (dot) path components are always