feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

app/schemas.py

@@ -22,6 +22,23 @@ class ChatRequest(BaseModel):
     message: str = Field(min_length=1, max_length=4000)
 
 
+class LoginRequest(BaseModel):
+    """``POST /api/login`` body (phase 16): the single admin's password.
+
+    An empty or wrong password is a 401 with one generic detail — never a
+    422 that would hint at input-shape differences.
+    """
+
+    password: str = ""
+
+
+class WhoamiResponse(BaseModel):
+    """``GET /api/whoami`` (phase 16) — drives all UI gating."""
+
+    authenticated: bool
+    role: str  # "admin" | "anonymous"
+
+
 class SourceRef(BaseModel):
     source: str
     path: str