preserve Tower Authentik operator login WIP

docs/API_CONTRACTS.md

@@ -99,6 +99,10 @@ Authenticated operator sessions return `role: "operator"`. Guest sessions
 return `role: "guest"` and the UUID of their bound demo project in
 `guest_project_id`.
 
+`authentik_enabled` in the session payload indicates whether the landing page
+may offer the additive Authentik operator login. Existing local and guest
+access remain unchanged.
+
 ### POST `/api/v1/auth/login`
 
 ```json
@@ -136,6 +140,14 @@ the request body against the guest-session scope.
 Clears the browser cookie and returns an unauthenticated session. Logout is
 idempotent and remains callable when the current cookie is missing or expired.
 
+### GET `/api/v1/auth/authentik/start`
+
+Starts authorization-code OIDC with PKCE, state and nonce for the configured
+single operator. The exact callback is `/api/v1/auth/authentik/callback`.
+Only the configured, verified operator e-mail is accepted; success creates the
+same operator session as local login. These redirect endpoints are the only
+additional non-envelope authentication responses.
+
 ## Health
 
 ### GET `/health/live`