feat: auth & admin

CLAUDE.md

@@ -26,9 +26,15 @@ uv run pytest tests/test_health.py::test_liveness_ok   # single test
 uv run alembic revision --autogenerate -m "msg"  # new migration (after model changes)
 uv run alembic upgrade head                       # apply migrations
 
-docker compose up --build            # full stack: api, worker, db, redis
+docker build -t mcma-backend .       # build this service's image (repo is infra-free)
 ```
 
+Orchestration is **not** in this repo. The workspace compose (`../docker-compose.yml`,
+shared with `mcma-webui`) wires the stack: `docker compose up -d` runs backing
+services only (db + redis) for local dev; `docker compose --profile app up --build`
+runs the full stack. The image takes every peer from env (`DATABASE_URL`, `REDIS_URL`,
+`MEDIA_PATH`, …) and hardcodes nothing.
+
 Tests run in-process against the ASGI app (httpx + asgi-lifespan) — no server, no network. They do **not** require a running DB/Redis: dependency-backed checks degrade rather than fail.
 
 ## Architecture — hexagonal (ports & adapters)