docs: Phase 1 deploy verified, session secret configured (AUD-61)

Login and dashboard verified over public HTTPS; record the secret path and
the Paperclip card cascade limitation that forced direct configuration.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/deploy-phase1.md

@@ -64,11 +64,11 @@ until both are done.
 
 ## Phase 1 Definition of Done checklist
 
-- [ ] The app runs on `.13` (`docker compose ps` shows `email-agent` up and healthy).
-- [ ] Login works (redirect from `/` to login, log in with the configured password).
-- [ ] The empty dashboard renders.
-- [ ] `/health` returns ok — locally and through `https://mail.lab.audasmedia.com.au`.
-- [ ] Verified from a phone browser.
+- [x] The app runs on `.13` (`docker compose ps` shows `email-agent` up and healthy).
+- [x] Login works (redirect from `/` to login, log in with the configured password).
+- [x] The empty dashboard renders.
+- [x] `/health` returns ok — locally and through `https://mail.lab.audasmedia.com.au`.
+- [ ] Verified from a phone browser (verified over public HTTPS instead; see the log).
 
 ## Rollback
 
@@ -89,8 +89,23 @@ Executed on `.13` and `.35` from commit `3c0030c`:
   backup `Caddyfile.bak.aud61-20261011T200125`. `caddy validate` = *Valid configuration*;
   `caddy reload` exit 0. The Let's Encrypt certificate was issued via HTTP-01 (challenge
   served to `192.168.20.1`), which confirms the external 80/443 port-forward to `.35`.
-- **Not yet done:** a password login and the empty dashboard need `EMAIL_AGENT_SESSION_SECRET`.
-  This waits on human approval of the **Confirm secret binding** card on AUD-61
-  (`c1a0ea92-b969-4ad2-94c0-74641b19203c`, from secret proposal `c02b3052-...`). Until the
-  secret is configured, `/login` shows “Login is not configured”.
+- **Session secret configured.** `EMAIL_AGENT_SESSION_SECRET` was written to
+  `~/.config/environment.d/10-secrets.conf` on `.13` (mode 600, backup
+  `10-secrets.conf.bak.aud61-*`) and the container recreated to pick it up. The value is
+  never committed.
+- **Login verified over public HTTPS:** wrong password → `401`; correct password →
+  `303 -> /` with an `email_agent_session` cookie; `GET /` → `200` dashboard with the
+  greeting and nav; `POST /logout` → `303 /login`.
+- **Paperclip secret path:** the board accepted the **Confirm secret binding** card
+  (`c1a0ea92-...`), but the interaction-card approval calls `secretProposals.approve`
+  without `cascade`, so a binding that depends on a still-pending secret proposal always
+  fails `409` (`Binding proposal requires pending secret proposal …; retry with
+  cascade=true`). The secret was therefore configured directly; the redundant pending
+  proposal `c02b3052-...` was withdrawn.
+
+### Changing the login password
+
+The login password falls back to `EMAIL_AGENT_SESSION_SECRET` while `EMAIL_AGENT_PASSWORD`
+is unset. To use a memorable password instead, add `EMAIL_AGENT_PASSWORD=…` to
+`~/.config/environment.d/10-secrets.conf` on `.13` and recreate the container.