feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

frontend/sources.html

@@ -34,6 +34,21 @@
         </p>
       </div>
 
+      <!-- Phase 16: anonymous sign-in gate. The catalog is what the
+           login locks — the document viewer itself stays public (soft
+           rule), so the copy says what stays open. -->
+      <section class="sources-gate" id="sources-gate" aria-labelledby="sources-gate-title" hidden>
+        <div class="sources-gate-glyph" aria-hidden="true">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="10" width="16" height="10" rx="2"/><path d="M8 10V7a4 4 0 0 1 8 0v3"/><circle cx="12" cy="14.5" r="1.4" fill="currentColor" stroke="none"/><path d="M12 16v2"/></svg>
+        </div>
+        <h2 id="sources-gate-title">Sign in to view the full catalog</h2>
+        <p class="sources-gate-sub">
+          The complete list of indexed documents is admin-only. Chat — and
+          any document an answer cites — stays open to everyone.
+        </p>
+        <a class="sources-gate-link" href="/login.html?next=/sources.html">Sign in</a>
+      </section>
+
       <div class="stat-cards" id="stat-cards">
         <div class="stat-card" role="group" aria-label="Document statistics">
           <span class="stat-value" id="stat-docs">–</span>