feat: add operator landing and login

docs/API_CONTRACTS.md

@@ -45,6 +45,57 @@ Any valid GeoJSON geometry object. V1 primarily expects `Polygon` and `MultiPoly
 }
 ```
 
+## Operator authentication
+
+Authentication is an optional single-operator access gate, not multi-user
+account management. When `GEOINTEL_AUTH_ENABLED=true`, every `/api/v1/*`
+request except the three authentication endpoints below requires a valid
+signed `geointel_session` cookie. Missing, expired or modified sessions return
+HTTP 401 with `AUTHENTICATION_REQUIRED`. Direct loopback calls to the backend
+without proxy headers remain available to trusted in-container operator tools;
+the backend is bound to loopback in the all-in-one runtime.
+
+The runtime stores only a PBKDF2-SHA256 password hash and an independent
+session-signing secret. The browser receives an HttpOnly, SameSite=Strict,
+time-limited cookie. Five failed attempts for one client/username combination
+within five minutes temporarily return HTTP 429 `LOGIN_RATE_LIMITED`.
+
+### GET `/api/v1/auth/session`
+
+Public session probe used by the frontend before it mounts the workbench.
+When authentication is disabled, `authenticated` is true and
+`authentication_required` is false so local development retains its existing
+direct workflow.
+
+```json
+{
+  "data": {
+    "authentication_required": true,
+    "authenticated": false,
+    "username": null,
+    "expires_at": null
+  }
+}
+```
+
+### POST `/api/v1/auth/login`
+
+```json
+{
+  "username": "operator",
+  "password": "user-supplied secret"
+}
+```
+
+Successful login sets the session cookie and returns the authenticated session
+shape. Invalid credentials return HTTP 401 `INVALID_CREDENTIALS`; username
+existence is not disclosed.
+
+### POST `/api/v1/auth/logout`
+
+Clears the browser cookie and returns an unauthenticated session. Logout is
+idempotent and remains callable when the current cookie is missing or expired.
+
 ## Health
 
 ### GET `/health/live`