Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/INSTALLATION.md

@@ -1,7 +1,17 @@
-# Installing ITWorx ModelForge v1.2.1
+# Installing ITWorx ModelForge — historical v1.2.3 procedure
 
-This is the whole installation. If you have to do something that is not written here, that is a
-defect — please report it rather than working around it.
+At the 2026-09-23 reconciliation checkpoint, the observed production installation ran v1.2.3 at
+schema `20260909_0032` and no v1.2.3 Gitea Release object existed. The current `1.3.0-rc.1` source targets
+`20260924_0039`; its qualification is established by an exact published release record, not this
+historical guide. The steps below preserve the earlier bounded fresh-install
+procedure; do not treat them as validation of the current RC archive, production upgrade, or
+rollback. Select exact source and image identities and complete the [RC acceptance gates](operations/RC_ACCEPTANCE.md)
+before using a candidate package. See the [current-state reconciliation](quality/CURRENT_STATE_RECONCILIATION_2026-09-24.md)
+and [upgrade boundary](UPGRADE.md#source-and-schema-boundary).
+
+
+The final RC installation procedure must be checked against its exact archive and isolated
+clean-install rehearsal; unresolved steps are release blockers.
 
 The steps below are release-gated against a fresh project with isolated volumes, newly generated
 test secrets and an empty PostgreSQL database.
@@ -74,14 +84,25 @@ MODELFORGE_OPERATOR_API_KEY=<generated, at least 32 characters>
 MODELFORGE_BACKUP_ENCRYPTION_KEY=<generated base64 AES-256 key>
 MODELFORGE_CORS_ORIGINS=https://modelforge.example.internal
 VITE_API_BASE_URL=https://modelforge.example.internal:8000
-MODELFORGE_VERSION=1.2.1
-MODELFORGE_API_IMAGE=modelforge-api:1.2.1
-MODELFORGE_WEB_IMAGE=modelforge-web:1.2.1
+MODELFORGE_VERSION=1.2.3
+MODELFORGE_API_IMAGE=modelforge-api:1.2.3
+MODELFORGE_WEB_IMAGE=modelforge-web:1.2.3
 ```
 
 Every setting is documented in [CONFIGURATION.md](CONFIGURATION.md), which is generated from the
 typed settings — it cannot drift from what the code actually reads.
 
+For browser password sign-in, run `python scripts/operator_password.py` and enter your chosen
+password at the hidden prompt. Put only the generated hash in `.env` as
+`MODELFORGE_OPERATOR_PASSWORD_HASH='<generated hash>'`. Keep the single quotes: they prevent
+Compose from interpreting the dollar signs in the hash. Keep the separate generated operator
+API key above for session signing and recovery. Never use your password as that API key.
+Recreate the API after changing either setting. Password sign-in returns a temporary session
+valid for at most 15 minutes; locking or reloading the console clears it. Rotating the password
+hash or API key invalidates existing password sessions. Login attempts require Redis and are
+limited across API processes to five per socket peer and thirty globally per minute.
+The console defaults to **Password**; **Advanced: API key recovery** retains direct key access.
+
 To move a port, set `MODELFORGE_API_PUBLISHED_PORT`, `MODELFORGE_WEB_PORT`,
 `MODELFORGE_POSTGRES_PORT` or `MODELFORGE_REDIS_PORT`. You never have to edit a Compose file.
 
@@ -119,7 +140,7 @@ path, but never derives a deployable image from a floating `latest` tag.
 To stamp build identity into the images so a running container can say where it came from:
 
 ```bash
-MODELFORGE_VERSION=1.2.1 \
+MODELFORGE_VERSION=1.2.3 \
 MODELFORGE_COMMIT=$(git rev-parse HEAD) \
 MODELFORGE_BUILT_AT=$(date -u +%FT%TZ) \
 docker compose -f docker-compose.yml -f docker-compose.production.yml up -d --build