Restore dashboard --enable-skip-login

Skip-login was stripped in an earlier "harden security" pass, which is
why the dashboard started demanding a token. Re-added it; it now runs
as the dashboard's own view-only ServiceAccount (get/list/watch), so
opening it needs no token but write access still requires the
admin-user token as before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/DASHBOARD_SETUP.md

@@ -49,14 +49,16 @@ kubectl get svc -n kubernetes-dashboard
 
 ### Login to Dashboard
 
-The dashboard is configured with `--enable-skip-login`, so you can skip the login screen. However, if you need to authenticate:
+The dashboard is configured with `--enable-skip-login`, so it opens straight to the UI - no token needed to look around.
 
-1. Get the token:
+Skip-login runs as the dashboard's own `kubernetes-dashboard` ServiceAccount, which is **view-only** (get/list/watch). If you need to edit, delete, or exec into something:
+
+1. Get an admin token:
 ```bash
 kubectl -n kubernetes-dashboard create token admin-user
 ```
 
-2. Copy the token and paste it in the dashboard login screen.
+2. Click "Sign In" on the dashboard and paste the token.
 
 ### What You Can See
 

manifests/alaska/k8s-dashboard.yaml

@@ -62,6 +62,13 @@ spec:
         args:
           - --auto-generate-certificates
           - --namespace=kubernetes-dashboard
+          - --enable-skip-login
+          # Skip-login uses the "kubernetes-dashboard" ServiceAccount below,
+          # which only has get/list/watch (view-only) - so opening the
+          # dashboard needs no token, but it can't edit/delete/exec.
+          # For write access, still log in with the admin-user token
+          # (kubectl -n kubernetes-dashboard create token admin-user).
+          #
           # --token-ttl=0 was tried here to disable the 15-min idle
           # timeout, but login broke immediately after that pod came up -
           # in this dashboard version, 0 appears to mean "expire