feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/conftest.py

@@ -15,6 +15,14 @@ from sqlalchemy.orm import Session
 # The production default stays 0.62 (app/config.py, A8 revised).
 os.environ.setdefault("BOR_RELEVANCE_THRESHOLD", "0.30")
 
+# Phase 16: single-admin auth is fail-loud — create_app() refuses to boot
+# without both vars, and app.main (imported below) builds the app at
+# import time. Set known test values first, same pattern as the threshold.
+ADMIN_PASSWORD = "test-admin-password"
+SESSION_SECRET = "test-session-secret-0123456789abcdef0123456789abcdef"
+os.environ.setdefault("BOR_ADMIN_PASSWORD", ADMIN_PASSWORD)
+os.environ.setdefault("BOR_SESSION_SECRET", SESSION_SECRET)
+
 from app.db import SessionLocal, db_available  # noqa: E402
 from app.main import app as fastapi_app  # noqa: E402
 
@@ -24,6 +32,19 @@ def client() -> TestClient:
     return TestClient(fastapi_app)
 
 
+@pytest.fixture()
+def admin_client(client: TestClient) -> TestClient:
+    """A client signed in as the single admin (phase 16).
+
+    TestClient keeps its cookie jar across requests, so one login covers
+    every subsequent request of the test. Use it for the admin-only
+    surface (``GET /api/docs``, ``/api/steering``).
+    """
+    r = client.post("/api/login", json={"password": ADMIN_PASSWORD})
+    assert r.status_code == 204, f"admin login failed: {r.status_code} {r.text}"
+    return client
+
+
 @pytest.fixture()
 def db() -> Iterator[Session]:
     """Real Postgres session (``podman compose up -d db``).