Update

deploy/unraid/README.md

@@ -86,6 +86,24 @@ the backend remain available to trusted in-container operator scripts.
 Production startup fails before replacing the active container when the
 password is empty or one of the documented defaults.
 
+Guest access is enabled by default when the operator login gate is active:
+
+```env
+GEOINTEL_GUEST_ACCESS_ENABLED=true
+GEOINTEL_GUEST_DISPLAY_NAME=Gast
+GEOINTEL_GUEST_SESSION_TTL_SECONDS=7200
+```
+
+No extra guest setting is required for a new authenticated deployment. Set
+`GEOINTEL_GUEST_ACCESS_ENABLED=false` to disable the button and guest endpoint.
+This adds **Als gast verkennen** to the landing page. The generated guest cookie
+is short-lived, project-scoped and limited to the canonical demo workflow.
+Operator mutations and access to another project are rejected by the backend,
+and the frontend hides management and task-starting controls. The mechanism is
+not tenant isolation: never enable it on an instance that contains private,
+customer or operational data. Deploy a separate demo container and storage
+root for public or recruiter-facing access.
+
 The repository deploy scripts run the same flow automatically. They validate
 the Compose reference, preserve the current image as
 `geointel-all-in-one:previous`, build an immutable `<commit-sha>-ai` or