Correct production operator username guidance

deploy/unraid/MANUAL_DEPLOY.md

@@ -94,7 +94,7 @@ in `.env`:
 
 ```bash
 cd /mnt/user/appdata/geointel
-bash scripts/configure_operator_login.sh --username jens@itworx.tech --guest-access true
+bash scripts/configure_operator_login.sh --username ITWorx --guest-access true
 ```
 
 `--guest-access true` is nodig om de demo-ingang te behouden; zonder die vlag
@@ -105,7 +105,7 @@ komt niet in je shell-history), en zet:
 
 ```env
 GEOINTEL_AUTH_ENABLED=true
-GEOINTEL_AUTH_USERNAME=jens@itworx.tech
+GEOINTEL_AUTH_USERNAME=ITWorx
 GEOINTEL_AUTH_PASSWORD_HASH=pbkdf2_sha256$600000$...
 GEOINTEL_AUTH_SESSION_SECRET=<48 willekeurige tekens>
 GEOINTEL_GUEST_ACCESS_ENABLED=false

docs/CODEX_EXECUTION_LOG.md

@@ -12140,3 +12140,29 @@ Open:
 
 - The proof state becomes complete only after real QA evidence exists. A spatial
   selection result without QA deliberately remains “awaiting verification”.
+
+## 2026-08-01 - Production operator username correction
+
+### Root cause and correction
+
+- Traced the failed operator login to an exact username mismatch: the active
+  Tower runtime was configured as `jens@itworx.tech`, while the required
+  operator username is `ITWorx`. Authentication intentionally performs an
+  exact, case-sensitive comparison.
+- Backed up the persistent production `.env`, changed only
+  `GEOINTEL_AUTH_USERNAME` to `ITWorx`, and retained the existing PBKDF2
+  password hash, session secret, session lifetime and guest-access setting.
+- Updated the operator-configuration examples to use `ITWorx`, preventing the
+  former email-style example from being copied back into production.
+
+### Deployment and verification
+
+- Restarted the release from `/mnt/user/appdata/geointel` with
+  `DEPLOY_GEOINTEL_INSTALL_AI=true`; the existing immutable NVIDIA/AI image
+  `geointel-all-in-one:b18e8460da32-wipb6567ba06f10-ai` was preserved.
+- The container became healthy. PostGIS 3.6, required runtime schema objects,
+  Alembic head `202607260001`, frontend, API proxy and icon checks passed.
+- Confirmed the active container exposes authentication as enabled with exact
+  username `ITWorx`; no plaintext password or password hash was printed or changed.
+- Targeted backend authentication suite passed from the backend root: 8 tests.
+- `bash -n scripts/configure_operator_login.sh` and `git diff --check` passed.

docs/TODO.md

@@ -1038,3 +1038,11 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] Voeg een responsieve desktop- en mobiele procesrail met reduced-motion fallback toe.
 - [x] Dek de statusresolver en het geverifieerde-bewijslabel af met gerichte componenttests.
 - [x] Controleer na Tower-redeploy de gastworkflow visueel op desktop en mobiel; operatorstatus gebruikt dezelfde componentcontracten.
+
+# Sprint 234 - Productie operator-login herstellen
+
+- [x] Bevestig de actieve operatorconfiguratie en identificeer de exacte gebruikersnaammismatch.
+- [x] Wijzig alleen de productiegebruikersnaam naar `ITWorx` en behoud de bestaande wachtwoordhash en sessiebeveiliging.
+- [x] Herstart vanuit `/mnt/user/appdata/geointel` met behoud van de NVIDIA/AI-image.
+- [x] Controleer containergezondheid, migraties, frontendproxy en actieve runtimeconfiguratie.
+- [x] Werk de operatorconfiguratievoorbeelden bij zodat toekomstige configuratie `ITWorx` gebruikt.

scripts/configure_operator_login.sh

@@ -6,11 +6,11 @@
 # never written to disk, never printed and never passed as a command argument.
 #
 # Usage:
-#   bash scripts/configure_operator_login.sh --username jens@itworx.tech
+#   bash scripts/configure_operator_login.sh --username ITWorx
 #     -> prompts for the password (nothing lands in shell history)
 #
 #   GEOINTEL_OPERATOR_PASSWORD='...' bash scripts/configure_operator_login.sh \
-#     --username jens@itworx.tech --non-interactive
+#     --username ITWorx --non-interactive
 #
 # Options:
 #   --username <value>    Operator login name. Required.