admin: token sign-in is the login — Sveltia rejects implicit, GitLab can't PKCE-exchange

public/admin/config.yml

@@ -9,13 +9,14 @@ backend:
   # (Sveltia does not infer them from the repo URL).
   base_url: https://git.nech.pl
   api_root: https://git.nech.pl/api/v4
-  # Auth: this GitLab (12.x-era) accepts the PKCE authorize step but fails the
-  # public-client token exchange ("failed to request an access token") — so we
-  # ride the implicit grant instead. The OAuth app must have "Implicit grant"
-  # checked; "Confidential" stays unchecked. Token is short-lived (GitLab
-  # default ~2h) — re-login expected; the Phase 1 auth sidecar replaces this
-  # with a confidential exchange + refresh.
-  auth_type: implicit
+  # Auth: Sveltia accepts ONLY auth_type "" (default) or "pkce" — it rejects
+  # implicit outright — and this 12.x-era GitLab cannot finish a PKCE
+  # public-client token exchange. Daily login therefore rides Sveltia's
+  # "Sign In with Token" (pln-cms personal access token, api scope,
+  # Developer on pln/www — project-confined). The Phase 1 `gate` sidecar
+  # (magic-link mail login, server-side confidential exchange) replaces this
+  # entirely. app_id kept for that future.
+  # auth_type intentionally omitted.
   # Paste the OAuth application ID from git.nech.pl (Admin area -> Applications;
   # redirect URI https://me.nech.pl/admin/, "Confidential" unchecked, api scope).
   app_id: d8696dc65c5f2308ce16f3a0ddbcfb913915562917ad4647cfaa3ea843dee287