feat(auth): single-admin password login (signed cookie) — gate tuning + Sources catalog, keep chat and document viewer public

tests/integration/test_importer_e2e.py

@@ -30,7 +30,7 @@ EXPECTED_DOCS = {
 }
 
 
-def test_import_fixtures_end_to_end(client, db) -> None:
+def test_import_fixtures_end_to_end(admin_client, db) -> None:
     db.execute(text("TRUNCATE chunks, documents, query_log"))
     db.commit()
     llm = FakeEmbedder()
@@ -67,7 +67,7 @@ def test_import_fixtures_end_to_end(client, db) -> None:
         assert c.embedding is not None and len(c.embedding) == 768
 
     # The Sources page consumes exactly this shape.
-    r = client.get("/api/docs")
+    r = admin_client.get("/api/docs")  # phase 16: the catalog is admin-only
     assert r.status_code == 200
     body = r.json()
     assert len(body["documents"]) == 8