Correct production operator username guidance

docs/CODEX_EXECUTION_LOG.md

@@ -12140,3 +12140,29 @@ Open:
 
 - The proof state becomes complete only after real QA evidence exists. A spatial
   selection result without QA deliberately remains “awaiting verification”.
+
+## 2026-08-01 - Production operator username correction
+
+### Root cause and correction
+
+- Traced the failed operator login to an exact username mismatch: the active
+  Tower runtime was configured as `jens@itworx.tech`, while the required
+  operator username is `ITWorx`. Authentication intentionally performs an
+  exact, case-sensitive comparison.
+- Backed up the persistent production `.env`, changed only
+  `GEOINTEL_AUTH_USERNAME` to `ITWorx`, and retained the existing PBKDF2
+  password hash, session secret, session lifetime and guest-access setting.
+- Updated the operator-configuration examples to use `ITWorx`, preventing the
+  former email-style example from being copied back into production.
+
+### Deployment and verification
+
+- Restarted the release from `/mnt/user/appdata/geointel` with
+  `DEPLOY_GEOINTEL_INSTALL_AI=true`; the existing immutable NVIDIA/AI image
+  `geointel-all-in-one:b18e8460da32-wipb6567ba06f10-ai` was preserved.
+- The container became healthy. PostGIS 3.6, required runtime schema objects,
+  Alembic head `202607260001`, frontend, API proxy and icon checks passed.
+- Confirmed the active container exposes authentication as enabled with exact
+  username `ITWorx`; no plaintext password or password hash was printed or changed.
+- Targeted backend authentication suite passed from the backend root: 8 tests.
+- `bash -n scripts/configure_operator_login.sh` and `git diff --check` passed.

docs/TODO.md

@@ -1038,3 +1038,11 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] Voeg een responsieve desktop- en mobiele procesrail met reduced-motion fallback toe.
 - [x] Dek de statusresolver en het geverifieerde-bewijslabel af met gerichte componenttests.
 - [x] Controleer na Tower-redeploy de gastworkflow visueel op desktop en mobiel; operatorstatus gebruikt dezelfde componentcontracten.
+
+# Sprint 234 - Productie operator-login herstellen
+
+- [x] Bevestig de actieve operatorconfiguratie en identificeer de exacte gebruikersnaammismatch.
+- [x] Wijzig alleen de productiegebruikersnaam naar `ITWorx` en behoud de bestaande wachtwoordhash en sessiebeveiliging.
+- [x] Herstart vanuit `/mnt/user/appdata/geointel` met behoud van de NVIDIA/AI-image.
+- [x] Controleer containergezondheid, migraties, frontendproxy en actieve runtimeconfiguratie.
+- [x] Werk de operatorconfiguratievoorbeelden bij zodat toekomstige configuratie `ITWorx` gebruikt.