feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/e2e/test_steering.py

@@ -1,5 +1,8 @@
 """Phase 15 E2E (Playwright): tune how Brain answers (steering notes).
 
+Phase 16 adaptation: tuning is admin-only — every test performs the real
+form login (``e2e.auth_helpers.login``) before touching the tuning UI.
+
 Story: ``.agent/user_stories/steering-notes.md``
 Run in isolation (DB must be up: ``podman compose up -d db``):
 
@@ -34,6 +37,7 @@ from app.db import SessionLocal
 from app.models import SteeringNote
 from app.rag.importer import ImportSummary, import_sources
 from app.rag.llm import LLMClient
+from e2e.auth_helpers import login
 
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
@@ -125,6 +129,7 @@ def test_tune_under_answer_persists_and_steers(
     assert summary is not None and summary.added == 8  # A9 formats
     page.set_default_timeout(30_000)
     page.goto(app_url)
+    login(page, app_url, next="/")  # phase 16: tuning is admin-only
     _ask(page, QUESTION)
 
     # The Tune control: ghost button in the answer's meta row, ≥44px.
@@ -165,6 +170,7 @@ def test_delete_note_stops_steering(
     _reset_db(mock_llm, seed=True)
     page.set_default_timeout(30_000)
     page.goto(app_url)
+    login(page, app_url, next="/")  # phase 16: tuning is admin-only
     _ask(page, QUESTION)
     _tune_and_save(page, NOTE)
 
@@ -202,6 +208,7 @@ def test_note_rendered_as_text_xss_safe(
     _reset_db(mock_llm, seed=True)
     page.set_default_timeout(30_000)
     page.goto(app_url)
+    login(page, app_url, next="/")  # phase 16: tuning is admin-only
 
     dialogs: list[str] = []
 
@@ -234,6 +241,7 @@ def test_tuning_panel_a11y(page: Page, app_url: str, db_ready: None) -> None:
     _reset_db(mock_port=0, seed=False)  # no KB seeding needed for the panel a11y
     page.set_default_timeout(30_000)
     page.goto(app_url)
+    login(page, app_url, next="/")  # phase 16: the panel is admin-only
 
     toggle = page.locator("#steering-toggle")
     panel = page.locator("#steering-panel")