T10.8 D13/D14 - documentation matches what the code now does

DEPLOY-login-portal.md was the most wrong and is rewritten. It described taking
a username/password portal live - bcrypt, and a first admin created with
`create-admin --password`. Every command in it now fails. It keeps its filename
and carries a note saying what it replaced, because an admin holding the old
copy needs to know why the steps stopped working rather than concluding the
deploy is broken. New content leads with the warning that there is no
break-glass, and puts verification BEFORE announcing the deploy - the log line,
the certificate check that binds nothing, then a real sign-in.

DEPLOYMENT.md: AUTH_RESET_* replaced with the LDAP variables; the users table
row no longer claims a password_hash column; "Self-service password reset"
replaced by a section saying there isn't one and pointing at Okta. New "Domain
authentication" section covering the three things that are not obvious - why
prime.local and never a DC or an IP, why the CA bundle is not a certificate
issued to this app (with the thumbprints and a Get-ChildItem line to rebuild
it), and why the outbound network stopped being optional - plus the lockout
arithmetic written out so the next person to raise AUTH_MAX_ATTEMPTS sees the
constraint rather than a magic 2.

server/README.md: endpoint table drops /api/auth/password and gains the role
route; the login-portal section becomes domain authentication; create-admin
becomes the two-step bootstrap (sign in, then promote).

CLAUDE.md: a new "authentication rules" section beside the token rule, for the
same reason that one exists - four things that look like tidying-up if you do
not know why. The empty-password guard that must run before bind(), CERT_REQUIRED
with an explicit CA file, AUTH_MAX_ATTEMPTS being arithmetic rather than taste,
and connecting to the domain name rather than a DC. Plus: no break-glass, and
roles are local - never read a role from AD.

Closed three done-when boxes that were open rather than ticked:

  T10.8  all of them
  T10.9  promote/demote verified against a real bind (Aug 24), not a stub
  T10.3  the Postgres round trip, on postgres:16-alpine

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/waves/wave-10.md

@@ -132,7 +132,7 @@ is criterion 4 and must keep working.
 **Done when:**
 
 - [ ] `grep -rn "password_hash\|hash_password\|verify_password\|password_problem" server/` returns nothing outside the migration
-- [ ] `alembic upgrade head` then `downgrade -1` round-trips on SQLite and on Postgres
+- [x] `alembic upgrade head` then `downgrade -1` round-trips on SQLite and on Postgres (16.15, the compose image — Aug 24; needed a pre-existing T8.6 migration bug fixed first, see `495d87d`)
 - [ ] the migration's `downgrade()` recreates the column nullable, not `NOT NULL` — there are no hashes to put back
 - [ ] `token_version` still invalidates sessions, exercised by a role change
 - [ ] `manage_users.py list`, `disable`, `enable` still work; `reset-password` is gone
@@ -331,12 +331,13 @@ happens when the DC is unreachable, whatever `T10.2` decides.
 
 **Done when:**
 
-- [ ] every new env var is documented in `server/.env.example` and `DEPLOYMENT.md`
-- [ ] the CA bundle procedure is reproducible by an admin who has not read this thread
-- [ ] `DEPLOY-login-portal.md` no longer instructs anyone to set a password
-- [ ] the DC-unreachable behaviour is stated explicitly
-- [ ] `IMPLEMENTATION.md` section 4 lists wave 10
-- [ ] no doc still claims passwords are stored as bcrypt hashes
+- [x] every new env var is documented in `server/.env.example` and `DEPLOYMENT.md`
+- [x] the CA bundle procedure is reproducible by an admin who has not read this thread — thumbprints and a `Get-ChildItem` one-liner in `DEPLOYMENT.md`
+- [x] `DEPLOY-login-portal.md` no longer instructs anyone to set a password — rewritten, with a note saying what it replaced so an admin holding the old copy is not misled
+- [x] the DC-unreachable behaviour is stated explicitly, with the diagnostic commands
+- [x] `IMPLEMENTATION.md` section 4 lists wave 10
+- [x] no doc still claims passwords are stored as bcrypt hashes (swept; remaining matches all say the opposite)
+- [x] `CLAUDE.md` carries the four load-bearing auth rules, next to the token rule
 
 ---
 
@@ -369,4 +370,4 @@ that would pull FastAPI and the whole application into a CLI startup for one INS
 - [x] the last active admin cannot be demoted
 - [x] an unknown account gives an error that says accounts are made on first sign-in
 - [x] every change writes an `AuditLog` row naming the operator
-- [ ] verified against a real domain bind rather than a stubbed `authenticate_operator`
+- [x] verified against a real domain bind — `promote` and `demote` confirmed working Aug 24 2026