feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_retrieval_quality.py

@@ -32,6 +32,7 @@ from app.db import SessionLocal
 from app.models import QueryLog
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -90,7 +91,15 @@ def test_multi_format_import_hidden_doc_excluded(
     assert summary.added == 8
     assert summary.formats == {"md": 4, "yaml": 1, "json": 1, "py": 1, "txt": 1}
 
-    r = httpx.get(f"{app_url}/api/docs", timeout=10)
+    # Phase 16: the catalog is admin-only — perform the real form login,
+    # then call the API with the signed cookie the browser now holds.
+    login(page, app_url, next="/sources.html")
+    cookies = {
+        c["name"]: c["value"]
+        for c in page.context.cookies()
+        if "name" in c and "value" in c
+    }
+    r = httpx.get(f"{app_url}/api/docs", timeout=10, cookies=cookies)
     assert r.status_code == 200
     docs = r.json()["documents"]
     assert len(docs) == 8
@@ -103,8 +112,7 @@ def test_multi_format_import_hidden_doc_excluded(
         "homelab/ssh/ssh_aliases.txt",
     }
 
-    # The Sources page reflects the same set.
-    page.goto(f"{app_url}/sources.html")
+    # The Sources page (we're already on it, signed in) reflects the set.
     expect(page.locator("#stat-docs")).to_have_text("8")
     expect(page.locator("#docs-tbody tr", has_text=".hidden")).to_have_count(0)