preserve Tower Authentik operator login WIP

docs/API_CONTRACTS.md

@@ -99,6 +99,10 @@ Authenticated operator sessions return `role: "operator"`. Guest sessions
 return `role: "guest"` and the UUID of their bound demo project in
 `guest_project_id`.
 
+`authentik_enabled` in the session payload indicates whether the landing page
+may offer the additive Authentik operator login. Existing local and guest
+access remain unchanged.
+
 ### POST `/api/v1/auth/login`
 
 ```json
@@ -136,6 +140,14 @@ the request body against the guest-session scope.
 Clears the browser cookie and returns an unauthenticated session. Logout is
 idempotent and remains callable when the current cookie is missing or expired.
 
+### GET `/api/v1/auth/authentik/start`
+
+Starts authorization-code OIDC with PKCE, state and nonce for the configured
+single operator. The exact callback is `/api/v1/auth/authentik/callback`.
+Only the configured, verified operator e-mail is accepted; success creates the
+same operator session as local login. These redirect endpoints are the only
+additional non-envelope authentication responses.
+
 ## Health
 
 ### GET `/health/live`

docs/CODEX_EXECUTION_LOG.md

@@ -12947,3 +12947,8 @@ Open:
 - Kept the historical evidence boundary explicit: this runtime receipt does not
   invent human review, a historical training commit/container, protected-test
   independence, national validity or a new promotion decision.
+# 2026-08-26 — Additive Authentik operator login
+
+- Added authorization-code OIDC with PKCE, signed state, nonce, strict issuer/audience validation and a verified e-mail allowlist.
+- Kept the existing local single-operator login and API-enforced project-scoped guest demo unchanged.
+- Added the Authentik action to the existing landing access card and documented the callback/environment contract.

docs/TODO.md

@@ -1244,3 +1244,4 @@ This file now starts with the current implementation status. Older preparation/b
   through a bottom rail and remove clipped result metrics.
 - [ ] Repeat the responsive audit with a physical touch device and screen
   reader before claiming full mobile accessibility certification.
+- [x] Offer Authentik as an additive single-operator login while retaining local recovery and the scoped guest demo.