add authenticated tenant-scoped sessions

docs/OPERATIONS.md

@@ -16,18 +16,20 @@ The expected health endpoints are:
 - API: `GET http://localhost:8000/api/v1/health/live`
 - Web: `GET http://localhost:8080/healthz`
 
-A service is ready only when Compose reports `healthy`; container running status alone is insufficient. The Compose environment explicitly carries `AUTOMATED_OUTREACH_ENABLED=false` as an operational safety setting.
+A service is ready only when Compose reports `healthy`; container running status alone is insufficient. Health checks call public liveness endpoints and must remain unauthenticated—do not add a session requirement to `/api/v1/health/live` or `/healthz`. The Compose environment explicitly carries `AUTOMATED_OUTREACH_ENABLED=false` as an operational safety setting.
 
 ## Configuration and deployment
 
-Copy `.env.example` for local development. Production values must be supplied by the deployment environment, never committed. Keep `AUTOMATED_OUTREACH_ENABLED=false`; automated outreach is explicitly disabled in this MVP and there is no supported production enablement path in this repository.
+Copy `.env.example` for local development. Production values must be supplied by the deployment environment, never committed. `BOOTSTRAP_ADMIN_EMAIL` and `BOOTSTRAP_ADMIN_PASSWORD` are optional API environment variables for first-run admin provisioning only; set them together through a secret store or protected deployment environment, remove them immediately after successful bootstrap, and rotate the password. Do not put real values in Compose files, CI variables visible to logs, images, or committed `.env` files.
+
+For production, use Argon2id for password hashing and require MFA for administrator accounts. Configure TLS before enabling `Secure` session cookies. Local Compose uses HTTP, so browser testing of the production `Secure` cookie behavior requires an HTTPS staging environment. Treat session cookies as bearer credentials: protect state-changing routes with CSRF controls, expire/revoke sessions, and never print cookie values in logs.
 
 Before deployment:
 
-1. Run `docker compose config` and review the rendered configuration.
+1. Run `docker compose config` and review the rendered configuration (optional bootstrap values should be empty in CI and local validation).
 2. Build from a reviewed commit and scan the resulting images.
 3. Restrict host/network exposure at the ingress/firewall.
-4. Verify both health checks and review logs for unexpected errors or sensitive data.
+4. Verify both unauthenticated health checks and review logs for unexpected errors or sensitive data.
 5. Record the image digest and configuration revision for rollback.
 
 ## Data, backups, and retention