feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/integration/test_api.py

@@ -56,6 +56,7 @@ def test_suggestions_honors_bor_suggestions_env_override(monkeypatch) -> None:
         ("/", "Brain of Reese"),
         ("/sources.html", "Knowledge base"),
         ("/document.html", "Brain of Reese"),  # phase 10: viewer page
+        ("/login.html", "Sign in"),  # phase 16: admin sign-in page
     ],
 )
 def test_html_pages_served_locally_no_cdn(client, path: str, marker: str) -> None:
@@ -75,6 +76,7 @@ def test_styles_and_js_served(client) -> None:
     assert client.get("/assets/sources.js").status_code == 200
     assert client.get("/assets/markdown.js").status_code == 200  # phase 10: shared renderer
     assert client.get("/assets/document.js").status_code == 200  # phase 10: viewer page
+    assert client.get("/assets/login.js").status_code == 200  # phase 16: login page
 
 
 # Emoji code points banned from UI chrome (phase 08): the pictograph
@@ -104,10 +106,12 @@ def _find_emoji(text: str) -> list[str]:
         "/",
         "/sources.html",
         "/document.html",
+        "/login.html",  # phase 16
         "/assets/app.js",
         "/assets/sources.js",
         "/assets/markdown.js",
         "/assets/document.js",
+        "/assets/login.js",  # phase 16
         "/assets/styles.css",
     ],
 )