feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_header_consistency.py

@@ -13,6 +13,11 @@ Test → story mapping (Playwright Mapping Rule):
 1. ``test_header_height_identical_across_pages_desktop``
 2. ``test_header_height_identical_across_pages_mobile``
 3. ``test_viewer_header_content_still_fits`` (phase-10 regression guard)
+
+Phase 16 adaptation: the auth control (Sign in / Sign out) joins the chat
+header's ``.header-inner`` — the desktop test verifies its presence in
+both auth states without the bar's height moving (height assertions
+unchanged).
 """
 from __future__ import annotations
 
@@ -28,6 +33,7 @@ from app.config import Settings
 from app.db import SessionLocal
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -111,6 +117,18 @@ def test_header_height_identical_across_pages_desktop(
         f"document header {heights['document']}px (was content-sized)"
     )
 
+    # Phase 16: the auth control lives in the same bar — anonymous sees
+    # "Sign in", signed-in sees "Sign out", and neither state moves the
+    # height.
+    page.goto(app_url + "/")
+    expect(page.locator("#sign-in-link")).to_be_visible()
+    expect(page.locator("#sign-out-btn")).to_be_hidden()
+    assert _box_height(page, ".app-header") == DESKTOP_HEADER_H
+    login(page, app_url, next="/")
+    expect(page.locator("#sign-out-btn")).to_be_visible()
+    expect(page.locator("#sign-in-link")).to_be_hidden()
+    assert _box_height(page, ".app-header") == DESKTOP_HEADER_H
+
 
 # ---------------------------------------------------------------------------
 # 2. Mobile (≤640px): all three pages, one identical 58px bar