admin: gate is the auth service — handshake login, translating api_root

public/admin/config.yml

@@ -9,14 +9,18 @@ backend:
   # (Sveltia does not infer them from the repo URL).
   base_url: https://git.nech.pl
   api_root: https://git.nech.pl/api/v4
-  # Auth: Sveltia accepts ONLY auth_type "" (default) or "pkce" — it rejects
-  # implicit outright — and this 12.x-era GitLab cannot finish a PKCE
-  # public-client token exchange. Daily login therefore rides Sveltia's
-  # "Sign In with Token" (pln-cms personal access token, api scope,
-  # Developer on pln/www — project-confined). The Phase 1 `gate` sidecar
-  # (magic-link mail login, server-side confidential exchange) replaces this
-  # entirely. app_id kept for that future.
-  # auth_type intentionally omitted.
+  # Auth: gate (api.nech.pl/gate/v1) is the auth service — magic email-code
+  # login, then a postMessage handshake hands Sveltia the pln-cms token.
+  # Rationale: Sveltia hardcodes Bearer (gitlab backend authScheme) and this
+  # 12.x-era GitLab only accepts PRIVATE-TOKEN, so Sveltia cannot talk to
+  # git.nech.pl directly — gate's /gitlab/ proxy translates, and gate's
+  # authorize page implements the Sveltia handshake natively (source-verified
+  # against sveltia-cms shared/auth.js + sveltia-cms-auth outputHTML).
+  # app_id kept only as history: direct GitLab OAuth (pkce) is unreachable on
+  # this GitLab version.
+  base_url: https://api.nech.pl
+  auth_endpoint: gate/v1/oauth/authorize
+  api_root: https://api.nech.pl/gate/v1/gitlab
   # Paste the OAuth application ID from git.nech.pl (Admin area -> Applications;
   # redirect URI https://me.nech.pl/admin/, "Confidential" unchecked, api scope).
   app_id: d8696dc65c5f2308ce16f3a0ddbcfb913915562917ad4647cfaa3ea843dee287