feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_import_documents.py

@@ -8,6 +8,9 @@ Run in isolation (DB must be up: ``podman compose up -d db``):
 Seeding runs the real import function in-process against
 ``tests/fixtures/docs/`` with the deterministic mock embeddings — it is a
 fixture, not the subject of the tests.
+
+Phase 16 adaptation: the Sources catalog is admin-only — every test
+performs the real form login (``e2e.auth_helpers.login``) first.
 """
 from __future__ import annotations
 
@@ -23,6 +26,7 @@ from app.config import Settings
 from app.db import SessionLocal
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -86,7 +90,7 @@ def test_sources_page_lists_indexed_docs(
     assert summary is not None and summary.added == 8
     assert summary.formats == {"md": 4, "yaml": 1, "json": 1, "py": 1, "txt": 1}
 
-    page.goto(f"{app_url}/sources.html")
+    login(page, app_url)  # phase 16: the catalog is admin-only
     expect(page.locator("#stat-docs")).to_have_text("8")
     expect(page.locator("#stat-chunks")).to_have_text(str(summary.chunks))
     expect(page.locator("#stat-last")).not_to_have_text("–")
@@ -105,7 +109,7 @@ def test_sources_table_layout(
     page: Page, browser: Browser, app_url: str, mock_llm: int, db_ready: None
 ) -> None:
     _reset_db(mock_llm, seed=True)
-    page.goto(f"{app_url}/sources.html")
+    login(page, app_url)  # phase 16: the catalog is admin-only
     page.locator("#docs-tbody tr").first.wait_for(state="visible")
 
     wrap = page.locator(".table-wrap")
@@ -124,7 +128,7 @@ def test_sources_table_layout(
     # scrolls horizontally instead of squeezing into a hairline.
     mobile = browser.new_page(viewport={"width": 375, "height": 812})
     try:
-        mobile.goto(f"{app_url}/sources.html")
+        login(mobile, app_url)  # phase 16: the catalog is admin-only
         mobile.locator("#docs-tbody tr").first.wait_for(state="visible")
         scroll_width, client_width = mobile.evaluate(
             "() => { const el = document.querySelector('.table-wrap');"
@@ -138,7 +142,7 @@ def test_sources_table_layout(
 def test_empty_state_when_no_docs(page: Page, app_url: str, mock_llm: int, db_ready: None) -> None:
     _reset_db(mock_llm, seed=False)
 
-    page.goto(f"{app_url}/sources.html")
+    login(page, app_url)  # phase 16: the (empty-state) catalog is admin-only
     expect(page.locator("#sources-empty")).to_be_visible()
     expect(page.locator("#sources-empty")).to_contain_text("Nothing indexed yet")
     expect(page.locator("#sources-empty code")).to_have_text(