chore: prepare repository for public release

docs/API_CONTRACTS.md

@@ -47,9 +47,11 @@ Any valid GeoJSON geometry object. V1 primarily expects `Polygon` and `MultiPoly
 
 ## Operator authentication and guest demo
 
-Authentication remains an optional single-operator access gate, not multi-user
-account management or tenant isolation. When `GEOINTEL_AUTH_ENABLED=true`,
-every `/api/v1/*` request except the four authentication endpoints below
+Authentication remains an optional single-operator access gate for local
+development and is enabled by default in the packaged Unraid runtime; it is not
+multi-user account management or tenant isolation. When
+`GEOINTEL_AUTH_ENABLED=true`, every `/api/v1/*` request except the six
+authentication routes below
 requires a valid signed `geointel_session` cookie. Missing, expired or modified
 sessions return HTTP 401 with `AUTHENTICATION_REQUIRED`. Direct loopback calls
 to the backend without proxy headers remain available to trusted in-container
@@ -57,9 +59,12 @@ operator tools; the backend is bound to loopback in the all-in-one runtime.
 
 The runtime stores only a PBKDF2-SHA256 operator password hash and an
 independent session-signing secret. The browser receives an HttpOnly,
-SameSite=Strict, time-limited cookie. Five failed operator-login attempts for
-one client/username combination within five minutes temporarily return HTTP
-429 `LOGIN_RATE_LIMITED`.
+SameSite=Strict, time-limited cookie. Packaged deployments also set
+`GEOINTEL_AUTH_REQUIRE_HTTPS=true`; plaintext password login then returns HTTP
+426 `AUTH_HTTPS_REQUIRED`. Five failed operator-login attempts for one resolved
+client/username combination within five minutes temporarily return HTTP 429
+`LOGIN_RATE_LIMITED`. Forwarded client addresses are accepted only from the
+loopback or container-proxy networks used by the shipped nginx topology.
 
 Optional guest access is a configuration-gated demonstration mode. It creates
 a shorter signed session with role `guest`, scopes that session to the
@@ -72,6 +77,7 @@ management, uploads, source/runtime configuration, evidence review and other
 administrative mutations remain unavailable. This is deliberately **not**
 a substitute for user accounts, authorization or tenant isolation; expose it
 only on a dedicated demo installation without private or operational data.
+Guest access defaults off and must be enabled explicitly.
 
 The functional demo boundary includes bounded, project-path-scoped official
 source acquisition, persisted bbox selections, temporal comparisons and change
@@ -131,7 +137,8 @@ return `role: "guest"` and the UUID of their bound demo project in
 
 Successful login sets the session cookie and returns the authenticated session
 shape. Invalid credentials return HTTP 401 `INVALID_CREDENTIALS`; username
-existence is not disclosed.
+existence is not disclosed. When HTTPS is required, a plaintext request returns
+HTTP 426 `AUTH_HTTPS_REQUIRED` before credentials are evaluated.
 
 ### GET `/api/v1/auth/authentik/start`