Make local login reachable, and write down how it works

Local login is implemented, wired through api, alerting and web, and
undiscoverable. No compose file turns it on, the Helm chart sets none
of its variables, and no markdown in the repository mentions
-seed-admin, LOCAL_AUTH_ENABLED or local login at all. The only way to
find it is to read cmd/api/main.go's authorizer switch.

Enabling it in docker-compose.yml is not the answer: a plain
`docker compose up` has no authentication, and every Phase 0-3 runbook
verifies the pipeline with bare curl against /query. Turning login on
by default would break the project's own documented verification.
So it's an opt-in overlay instead.

Four settings have to agree, and only one of them is obviously about
login. Each fails differently and none of the failures name the cause:
the route 404s, or the browser refuses the request before sending it,
or login returns 200 and every later request is anonymous because the
cookie was never stored, or the same symptom again from the opposite
end because the bundle never attaches it. That is what the new document
is mostly for.

The Helm chart still has no local-login support. Recorded in the
document as a gap rather than papered over.

Signed-off-by: John Coffey <[email protected]>

README.md

@@ -111,6 +111,25 @@ cluster. Override per invocation:
 COMPOSE_PROFILES=enterprise docker compose up
 ```
 
+### Signing in
+
+A plain `docker compose up` has **no authentication** — every runbook in
+`docs/` verifies the pipeline with bare `curl` against `/query`, and those
+steps depend on that. For a login screen without an identity provider behind
+it, add the local-login overlay:
+
+```sh
+docker compose -f docker-compose.yml -f docker-compose.local-auth.yml up -d --build
+docker compose -f docker-compose.yml -f docker-compose.local-auth.yml run --rm api -seed-admin
+```
+
+The second command prints a generated password once. Full detail, including
+what each setting does and how each one fails on its own, is in
+[`docs/local-login.md`](docs/local-login.md).
+
+SSO (OIDC/SAML) is the other option and takes precedence over local login
+where both are configured — see [`docs/phase-4-runbook.md`](docs/phase-4-runbook.md).
+
 Kubernetes deployment via the Helm chart in [`deploy/`](deploy/README.md).
 
 ## Status