feat: add operator landing and login

docs/API_CONTRACTS.md

@@ -45,6 +45,57 @@ Any valid GeoJSON geometry object. V1 primarily expects `Polygon` and `MultiPoly
 }
 ```
 
+## Operator authentication
+
+Authentication is an optional single-operator access gate, not multi-user
+account management. When `GEOINTEL_AUTH_ENABLED=true`, every `/api/v1/*`
+request except the three authentication endpoints below requires a valid
+signed `geointel_session` cookie. Missing, expired or modified sessions return
+HTTP 401 with `AUTHENTICATION_REQUIRED`. Direct loopback calls to the backend
+without proxy headers remain available to trusted in-container operator tools;
+the backend is bound to loopback in the all-in-one runtime.
+
+The runtime stores only a PBKDF2-SHA256 password hash and an independent
+session-signing secret. The browser receives an HttpOnly, SameSite=Strict,
+time-limited cookie. Five failed attempts for one client/username combination
+within five minutes temporarily return HTTP 429 `LOGIN_RATE_LIMITED`.
+
+### GET `/api/v1/auth/session`
+
+Public session probe used by the frontend before it mounts the workbench.
+When authentication is disabled, `authenticated` is true and
+`authentication_required` is false so local development retains its existing
+direct workflow.
+
+```json
+{
+  "data": {
+    "authentication_required": true,
+    "authenticated": false,
+    "username": null,
+    "expires_at": null
+  }
+}
+```
+
+### POST `/api/v1/auth/login`
+
+```json
+{
+  "username": "operator",
+  "password": "user-supplied secret"
+}
+```
+
+Successful login sets the session cookie and returns the authenticated session
+shape. Invalid credentials return HTTP 401 `INVALID_CREDENTIALS`; username
+existence is not disclosed.
+
+### POST `/api/v1/auth/logout`
+
+Clears the browser cookie and returns an unauthenticated session. Logout is
+idempotent and remains callable when the current cookie is missing or expired.
+
 ## Health
 
 ### GET `/health/live`

docs/CODEX_EXECUTION_LOG.md

@@ -11215,3 +11215,32 @@ Pre-release evidence:
   coverage 1.0, mean 159.3529 m DNG, minimum 51.7473 m DNG, maximum 223.4930
   m DNG and mean slope 5.2786 degrees. Water depth and volume remain explicitly
   unsupported because an MNT cannot establish either quantity.
+
+## 2026-07-22 - Stitch landing page and operator login
+
+Implemented:
+
+- translated the supplied `stitch_geointel_complete_workbench_redesign.zip`
+  into a native responsive React landing page rather than embedding its static
+  Tailwind mockup or temporary external image URLs;
+- added a project-owned optimized Belgium/North Sea hero asset and kept the
+  existing operational workbench unchanged behind the access boundary;
+- added public session probing, server-side PBKDF2-SHA256 credential checks,
+  signed HttpOnly/SameSite session cookies, expiry, failed-login throttling and
+  idempotent logout;
+- protected proxied browser API requests while retaining trusted direct
+  loopback access for in-container operator scripts; no account table,
+  registration, role system or other multi-user scope was introduced;
+- extended the Unraid environment/template and release runtime smoke to carry
+  the login configuration without storing a plaintext password.
+
+Pre-deployment validation:
+
+- the complete readiness gate passed with 1,107 backend tests and 36 frontend
+  tests, backend compile, API/documentation contract audit, frontend typecheck,
+  production build, Alembic head `202607160001` and all script checks;
+- the authentication tests cover unauthenticated API rejection, successful
+  login with an HttpOnly/SameSite cookie, logout, signature tampering and the
+  deployment guarantee that only a password hash reaches the container.
+
+Live deployment and login-journey evidence are appended after rollout.

docs/KNOWN_LIMITATIONS.md

@@ -6,6 +6,11 @@ These limitations are explicit, bounded and non-deceptive. None is a hidden
 CRITICAL or HIGH release defect. Coverage and capability responses remain the
 runtime source of truth.
 
+- The access gate intentionally supports one environment-configured operator
+  account. There is no registration, password-recovery email, role model,
+  organisation management or multi-user database. Password rotation is an
+  operator configuration action followed by a runtime restart.
+
 ## Source coverage
 
 - National administrative land and maritime scope is operational from

docs/TODO.md

@@ -2,6 +2,11 @@
 
 ## Actieve post-RC datadekkingsfase
 
+- [x] Implementeer de aangeleverde Stitch-landingspagina als echte React-
+  toegangspoort en bescherm de workbench met één veilig geconfigureerd
+  operatoraccount, sessieverval, uitloggen en zichtbare foutstatussen. Dit is
+  geen multi-user- of tenantbeheersysteem.
+
 `docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md` was het autonome
 uitvoeringsbord na `v1.0.0-rc.1` en is nu afgesloten voor `v1.0.0`. Dit is geen
 RC-12. De definitieve release blijft immutable bewijs; verdere databronnen