feat: add operator landing and login

docs/CODEX_EXECUTION_LOG.md

@@ -11215,3 +11215,32 @@ Pre-release evidence:
   coverage 1.0, mean 159.3529 m DNG, minimum 51.7473 m DNG, maximum 223.4930
   m DNG and mean slope 5.2786 degrees. Water depth and volume remain explicitly
   unsupported because an MNT cannot establish either quantity.
+
+## 2026-07-22 - Stitch landing page and operator login
+
+Implemented:
+
+- translated the supplied `stitch_geointel_complete_workbench_redesign.zip`
+  into a native responsive React landing page rather than embedding its static
+  Tailwind mockup or temporary external image URLs;
+- added a project-owned optimized Belgium/North Sea hero asset and kept the
+  existing operational workbench unchanged behind the access boundary;
+- added public session probing, server-side PBKDF2-SHA256 credential checks,
+  signed HttpOnly/SameSite session cookies, expiry, failed-login throttling and
+  idempotent logout;
+- protected proxied browser API requests while retaining trusted direct
+  loopback access for in-container operator scripts; no account table,
+  registration, role system or other multi-user scope was introduced;
+- extended the Unraid environment/template and release runtime smoke to carry
+  the login configuration without storing a plaintext password.
+
+Pre-deployment validation:
+
+- the complete readiness gate passed with 1,107 backend tests and 36 frontend
+  tests, backend compile, API/documentation contract audit, frontend typecheck,
+  production build, Alembic head `202607160001` and all script checks;
+- the authentication tests cover unauthenticated API rejection, successful
+  login with an HttpOnly/SameSite cookie, logout, signature tampering and the
+  deployment guarantee that only a password hash reaches the container.
+
+Live deployment and login-journey evidence are appended after rollout.