Add whole-app password protection

README.md

@@ -27,6 +27,29 @@ cp .env.example .env
 The app loads `.env` automatically. The default OpenAI model is `gpt-5.6-terra`;
 override it with `RESUME_AGENT_MODEL` or `--model`.
 
+Configure the single-user login before starting the web app:
+
+```dotenv
+RESUME_AGENT_USERNAME=your-username
+RESUME_AGENT_PASSWORD=replace-with-a-long-random-password
+```
+
+You can generate a strong password with:
+
+```bash
+uv run python -c "import secrets; print(secrets.token_urlsafe(32))"
+```
+
+Authentication covers the Signal interface, APIs, downloads, static files, and the
+bundled Oh My CV editor. The server fails closed with HTTP 503 when either credential is
+missing or still uses the placeholder value. Your browser will display its standard
+username/password prompt. Oh My CV offline caching is disabled so its app shell cannot
+bypass the server authentication gate.
+
+HTTP Basic authentication protects credentials only when the connection uses HTTPS.
+Binding to localhost is suitable for personal use; if the app is reachable from another
+machine, place it behind an HTTPS reverse proxy and do not expose the plain HTTP port.
+
 For an OpenAI-compatible provider, configure the endpoint without putting credentials
 in the repository:
 
@@ -87,7 +110,7 @@ After configuring `.env`, build and start the complete app with:
 docker compose up --build
 ```
 
-Open `http://127.0.0.1:8000`. The image builds Oh My CV and serves it from `/cv/` through
+Open `http://127.0.0.1:8900`. The image builds Oh My CV and serves it from `/cv/` through
 the same FastAPI process. Career-profile state and generated resumes persist in the
 host's `.resume-agent/` and `output/` directories.