feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_chat_persistence.py

@@ -33,6 +33,7 @@ from app.config import Settings
 from app.db import SessionLocal
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -271,7 +272,9 @@ def test_persists_across_page_navigation(
     _ask_deflected(page, OFF_TOPIC)  # mixed conversation: grounded + deflected
 
     # A trip to Sources — the New chat control is chat-page-only.
-    page.goto(app_url + "/sources.html")
+    # (Phase 16: the catalog is admin-only — the trip starts with a
+    # real form login.)
+    login(page, app_url, next="/sources.html")
     expect(page.locator("#docs-tbody tr").first).to_be_visible(timeout=15_000)
     expect(page.locator("#new-chat-btn")).to_have_count(0)