Production Login page passcode updates

app/api/schemas.py

@@ -63,12 +63,39 @@ class SourceProductOut(BaseModel):
 # Health
 # ---------------------------------------------------------------------------
 
+class AuthConfigOut(BaseModel):
+    """
+    The effective auth configuration, reported by /api/health.
+
+    Unauthenticated on purpose. The failure this exists to diagnose is "nobody
+    can sign in", so anything gated behind an admin token is unreachable
+    exactly when it is needed. Nothing here is a secret: the admin username is
+    already the documented one, allow_any_login=true is a fact an operator
+    urgently needs (and an attacker discovers with a single login attempt
+    anyway), and the fingerprint is a truncated hash of a salted digest, not a
+    password. What it buys is a one-command answer to "is this deployment
+    running the config I think it is?" - compare the fingerprint here against
+    the one printed by scripts/make_auth_secrets.py --fingerprint.
+    """
+
+    enabled: bool
+    allow_any_login: bool
+    admin_username: str
+    password_hash_valid: bool
+    password_hash_iterations: Optional[int] = None
+    password_hash_fingerprint: str
+    # "process-env" | "env-file" | "default" - which one actually won.
+    admin_username_source: str
+    password_hash_source: str
+
+
 class HealthOut(BaseModel):
     status: str
     database: bool
     ollama: bool
     ollama_model: str
     embeddings_model: str
+    auth: AuthConfigOut
 
 
 # ---------------------------------------------------------------------------