docs: Sign in and accounts, the login page beside API keys

[webdevtodayjason]

The docs half of the front door login (product #261). A person signs in to the dashboard with a name and a password, and the session lasts until sign out or until an admin revokes it. Programs keep presenting an API key. The docs described only the key half, so somebody opening a protected node had no page telling them how a person gets in.

The code is being built on three other branches. Nothing here claims a version: where the contract is not settled yet, the page says it is described in the release notes rather than guessing a number or a flag.

Pages touched

Page	What changed
security/sign-in.mdx	New. Why there is a login (a key is a machine credential, a login belongs to a person), the first account on a fresh node and on a running fleet, signing in, the account page, the Users page and the two roles, the CLI block, HTTPS before you hand out accounts, the two files and their modes, the guard rails, the open paths, the doctor's Login check, and troubleshooting
security/api-keys.mdx	A note under the opening warning that a key is for programs and a person signs in instead, linking the new page. Two rows in the exceptions table: GET /api/auth/me and POST /api/auth/login. The sentence that counted "five exceptions" no longer counts, because a count is the thing that drifts
docs.json	One line: security/sign-in first in the Security group, next to security/api-keys

What the new page says

• Two credentials, both live at once. A person presents a name and a password and gets a session; a program presents Authorization: Bearer <key>. One table, then a link to API keys for the key half.
• The first account is CLI work on the master, because the first one cannot be made from a page that needs an account to open: ainode auth user add <name> --admin (it prompts; --password-stdin for a script), then ainode auth enable if the node is not already requiring auth. A fresh install already requires a key, so there it is one command.
• Accounts are managed on the master and replicated to every node. Sessions are per node. That pair is stated where a fleet operator will hit it, and again in troubleshooting for "I can sign in on one node and not another".
• HTTPS before you hand out accounts. A sign-in over plain HTTP puts the password on the LAN in the clear. The section links TLS rather than repeating it, and says the session cookie is marked Secure over HTTPS.
• The guard rails, one line each: HttpOnly cookie, Secure over HTTPS, X-AINode-Client: dashboard on every dashboard write as the CSRF guard (another site can make your browser send the cookie, it cannot make it send that header), ten failed sign-ins in five minutes pausing that address, scrypt hashes.
• The open paths with auth on, as a table with a reason per row, including the two the sign-in itself needs.
• Troubleshooting: locked out (ainode auth user passwd from the node's own terminal, which needs no session), no accounts yet, a session that was revoked, a program answering 401, and one node signed in but not another.

Gates

$ npx --yes --package=mintlify@4.2.909 mintlify broken-links
success no broken links found

$ grep -c $'—' security/sign-in.mdx security/api-keys.mdx docs.json
security/sign-in.mdx:0
security/api-keys.mdx:0
docs.json:0

Left out

• No version number anywhere. Not in the page, not in the frontmatter. The release that carries the login is named in the release notes.
• No API reference page for the login routes. api-reference/overview.mdx still describes the key as the only credential. The route shapes (POST /api/auth/login, logout, the session and user routes) are not in the contract I was given beyond the open-path list, and an API page that guesses request and response bodies is worse than no page.
• How long the sign-in pause lasts after ten failures, and what the doctor's Login check verdicts on. Both are called out as described in the release notes instead of invented.
• cluster/endpoint.mdx still lists the exempt paths as "alongside /api/health, /api/auth/status and POST /api/cluster/join". It claims no count, and the api-keys table is the authority, so it was left alone.
• No screenshots. The dashboard's login page, account page and Users page are still being built.

Product README and the changelog text for the release PR: getainode/ainode#263.