feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_dark_tech_theme.py

@@ -42,6 +42,7 @@ from app.config import Settings
 from app.db import SessionLocal
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -212,8 +213,9 @@ def test_dark_palette_and_contrast(
     _assert_aa(pairs["button"], "dark ink on brand (send button)")
     _assert_aa(pairs["chip"], "chip ink on chip bg (chat)")
 
-    # Sources page pairs.
-    page.goto(f"{app_url}/sources.html")
+    # Sources page pairs. (Phase 16: the stat cards are admin-only —
+    # a real form login first.)
+    login(page, app_url, next="/sources.html")
     page.locator(".stat-card").first.wait_for(state="visible", timeout=10_000)
     pairs = page.evaluate(
         """() => {