Log the 2026-08-24 session: F3 fix live, audit filled, corpus re-ingest scoped

README.md

@@ -12,7 +12,7 @@ The former numbered `00–29` material and historical plans are retained in
 there until reviewed. See the canonical
 [documentation policy](docs/documentation-policy.md) for source precedence.
 
-> **Status** (2026-08-18): **live in production at
+> **Status** (2026-08-24): **live in production at
 > [realvuxbaro.me](https://realvuxbaro.me)**, running on **k3s + ArgoCD**
 > since the 2026-08-17 cutover — a real RAG chatbot over the whole
 > formulary, not a scaffold. What exists and what does not:
@@ -22,7 +22,7 @@ there until reviewed. See the canonical
 > | `ingestion/` | Done — 15,100 chunks embedded and loaded into Qdrant `duocthu_v1` |
 > | `apps/ai-service/` | Done — live grounded RAG (retrieval, generation, grounding, abstention, citations, traces) |
 > | `apps/web/` | Done — chat UI with citation/evidence panel, optional login |
-> | `apps/auth-service`, `apps/api-gateway` | **Built** (real NestJS: register/login/JWT, `/auth/*` proxy) but **disabled by default** in the Helm chart — not yet live on production. Seed accounts (`admin`/`demo`) use placeholder passwords not safe to expose publicly as-is |
+> | `apps/auth-service`, `apps/api-gateway` | **Live since 2026-08-19** (real NestJS: register/login/JWT, `/auth/*` proxy) with a `/login` page. Verified 2026-08-24: `POST /api/auth/login` with the seed `demo` account returns a session. Login stays **optional** — anonymous chat is unaffected. Seed accounts (`admin`/`demo`) still use placeholder passwords and are **not** safe to expose publicly as-is |
 > | `apps/user-service`, `apps/chat-service` | **Not built** — `README.md` + `package.json` only |
 > | `apps/mobile/` | **Not built** — reserved |
 > | `infra/docker/` | Compose is **stopped** (was production through 2026-08-17); still used for local dev (Postgres/Qdrant/observability), not for deploying anywhere |