sync: update from private repo (2336949a)

docs/docker.md

@@ -20,11 +20,46 @@ opens a setup wizard in the UI where you point MAESTRO at your LLM. To preset th
 endpoint instead, `cp .env.example .env` and set `OLLAMA_BASE_URL`/`OLLAMA_MODEL`
 (see [The LLM endpoint](#the-llm-endpoint)).
 
-Compose publishes the UI on `9876` on **all host interfaces**, so a Docker host
-is reachable from your LAN out of the box. That also means a fresh instance is
-exposed and **unauthenticated** — anyone who can reach the port can run code on
-the host via the agent's Bash tool. Read [Going beyond localhost](#going-beyond-localhost)
-before leaving it up on a shared network.
+**A fresh container starts with a login.** Compose publishes `9876` on all host
+interfaces, so a Docker host is reachable from your LAN out of the box — and the
+agent's Bash tool would hand anyone who reaches it code execution. So a new
+install that binds a non-loopback interface generates an admin account on first
+boot and prints the password:
+
+```console
+$ docker compose logs maestro | grep initial-admin
+[initial-admin] ... Sign in as admin@localhost / <generated password> ...
+```
+
+The same password is written to `data/.initial-admin-password` (mode `0600`) in
+case the log has scrolled away. Sign in, then change it under
+**Settings → Preferences** — the reminder stops and the file is removed once you
+do. The setup wizard lives behind that login, so sign in first and configure the
+LLM afterwards.
+
+This only happens on a **fresh** install with no `auth` section in
+`config.yaml`. An existing deployment is never switched to a login behind your
+back; if it is unauthenticated and reachable, the UI shows a standing warning
+instead. See [Going beyond localhost](#going-beyond-localhost).
+
+Two consequences worth knowing up front:
+
+- **Rebuilding the container keeps the login.** `config.yaml` lives in the image
+  layer, so `docker compose up -d --build` resets it while `/app/data` (and your
+  admin account) survives on the named volume. Boot notices the mismatch and
+  turns `auth.local` back on — your existing password keeps working, nothing is
+  regenerated. Everything *else* you saved in Settings is still lost on a
+  rebuild: bind-mount `config.yaml` (writable) or point `AAO_CONFIG` at a path
+  under the data volume to keep it. To turn the login off deliberately, write
+  `auth.local.enabled: false` — an explicit setting is never overwritten.
+- **A read-only `config.yaml` makes a fresh install refuse to start.** It cannot
+  write the auth setting, and coming up unauthenticated on a reachable interface
+  is the one outcome nobody would notice. Make the file writable, configure auth
+  yourself, or bind loopback.
+- **Wiping the data volume while keeping `config.yaml` does not lock you out.**
+  `docker compose down -v` leaves a config that says "auth on" with no account
+  behind it; boot notices and mints a fresh admin, printed the same way. If an
+  OAuth provider is configured, it does nothing — you can still sign in there.
 
 ### Windows (WSL2)
 
@@ -133,10 +168,11 @@ Rebuild after pulling new code with `docker compose up -d --build`.
 ## Going beyond localhost
 
 By default Compose publishes `9876` on all interfaces, so the instance is already
-reachable from your LAN — **and unauthenticated**. Before you rely on it on any
-shared or untrusted network, harden it:
+reachable from your LAN. A fresh install starts with a generated admin login (see
+[Quick start](#quick-start)), but that is the floor, not a finished setup. Before
+you rely on it on any shared or untrusted network, harden it:
 
-1. Enable authentication (OAuth, or local accounts).
+1. Change the generated password, or switch to OAuth / your own local accounts.
 2. Set `safety.bash_sandbox: always`.
 3. Terminate TLS — either MAESTRO's native HTTPS or a reverse proxy in front.