Add login gate, rate limiting, and container deploy files for company-wide use

README.md

@@ -126,6 +126,35 @@ git commit -m "Describe your change here"
 
 The `.gitignore` file excludes `node_modules` and common system files from commits.
 
+## Deploy for the whole company
+
+Use this when the tool needs to be reachable by anyone on the internal network or VPN, not just on one person's machine. This uses a company-owned Anthropic API key shared by everyone who reaches the tool, so it adds a login gate and a request cap that a solo local setup does not need.
+
+1. Get an Anthropic API key billed to a company account, not a personal one. IT or finance should provision this, since it is billed like any other company vendor cost.
+2. Pick a shared username and password for this tool. This is a simple login gate, not a full identity system. It exists so the tool is not reachable by anyone who is merely on the same network segment, but treat the VPN and internal network as the primary control, not this login.
+3. On the host or container platform, set these values as environment variables, or in a `.env` file next to `docker-compose.yml`:
+   ```
+   ANTHROPIC_API_KEY=<company key>
+   APP_USERNAME=<shared username>
+   APP_PASSWORD=<shared password>
+   ```
+4. Build and run the container:
+   ```
+   docker compose up -d --build
+   ```
+5. To run this alongside the existing Work Package Suite container instead of on its own, copy the `sde-meeting-toolkit` service block from `docker-compose.yml` into that stack's compose file, and apply the same environment variables there.
+6. Confirm the login prompt appears when you open the tool's URL from another machine on the network.
+
+### What the login gate does and does not do
+
+- It requires a username and password before any page or API call on this tool succeeds.
+- It does not encrypt traffic on its own. Run this behind the same network and VPN protections used for the Work Package Suite, and add TLS at the reverse proxy or load balancer if one is already in place for that stack.
+- It does not track who made which AI draft request. Every user shares one login and one API key. If per-person attribution matters later, that needs a real identity integration, which is a larger change than this tool currently supports.
+
+### Rate limit
+
+`RATE_LIMIT_MAX` and `RATE_LIMIT_WINDOW_MS` cap AI draft requests per source IP address, to prevent a leaked link or a stuck script from running up cost on the shared key. Defaults: 20 requests per 5 minutes. Raise these in `.env` if real usage hits the limit; the tool returns a clear rate-limit error rather than failing silently.
+
 ## Relation to the Work Package Suite
 
 These tools support meetings about the Work Package Suite project. The tools do not call the Work Package Suite application. The tools do not read or write Work Package Suite data. Treat this toolkit and the Work Package Suite codebase as separate projects.