M8: add operational authentication mode

docs/17-runbook.md

@@ -30,6 +30,21 @@ docker compose run --rm api pytest -q      # all tests pass
 docker compose run --rm api ruff check .   # clean
 ```
 
+## Operational mode (non-demo login)
+
+Keep the current demonstration environment on `MOBILITYOPS_DEMO_MODE=true`. For an
+operational deployment, set `MOBILITYOPS_DEMO_MODE=false`, `DEMO_ALLOW_RESET=false` and
+provide `INITIAL_ADMIN_EMAIL`, `INITIAL_ADMIN_PASSWORD` (at least 8 characters) and an
+optional `INITIAL_ADMIN_DISPLAY_NAME` in the deployment's untracked secret environment.
+On startup the API creates the first active Operations Manager only when no user with that
+email exists. The sign-in page then accepts email/password instead of exposing demo roles;
+demo reset, the guided tour and the synthetic-data badge are hidden.
+
+Use a long unique `APP_SECRET`, set `SESSION_COOKIE_SECURE=true` once the public endpoint
+uses HTTPS, and keep `INITIAL_ADMIN_PASSWORD` out of Git and logs. Existing sessions are
+revalidated against the current user record on every request, so deactivating an account
+invalidates its next request.
+
 ## n8n automation (one-time per environment)
 
 The n8n image used here (n8nio/n8n:latest, 2.x) requires an owner account before any