Add web auth, infinite-scroll, agent admission and review fixes across agent/server/web

docs/operations/deployment.md

@@ -50,7 +50,7 @@ Web is read-only for monitoring state in v1. Agent admission and blacklist contr
 
 Auth plan:
 
-- reverse proxy basic auth or equivalent gateway auth;
+- local web login or equivalent gateway auth through a trusted reverse proxy;
 - no full RBAC in v1.
 
 ## Observability

docs/ops/deployment-checklist.md

@@ -5,6 +5,7 @@ A pragmatic list for the first production-ish Monlet stand-up. Adjust per enviro
 ## 1. Secrets
 
 - [ ] Generate `MONLET_AUTH_TOKEN` (`openssl rand -hex 32`) and store it in your secret manager.
+- [ ] Generate `MONLET_WEB_SESSION_SECRET` (`openssl rand -hex 32`) if local web login is enabled.
 - [ ] Generate a PostgreSQL password and store it in your secret manager.
 - [ ] Decide which notifier channels you want and gather their credentials (Telegram bot token + chat id, webhook URL, Alertmanager URL).
 
@@ -41,7 +42,8 @@ A pragmatic list for the first production-ish Monlet stand-up. Adjust per enviro
 ## 6. Web UI
 
 - [ ] Set `MONLET_API_BASE_URL`, `MONLET_API_TOKEN`, and optional `MONLET_WEB_TIME_ZONE` for the web container.
-- [ ] Protect the web UI with either `MONLET_WEB_AUTH_USERNAME`/`MONLET_WEB_AUTH_PASSWORD` or a trusted reverse proxy that sets `X-Forwarded-User` plus `MONLET_WEB_TRUST_PROXY_AUTH=true`.
+- [ ] Protect the web UI with either local login (`MONLET_WEB_AUTH_USERNAME`, `MONLET_WEB_AUTH_PASSWORD`, `MONLET_WEB_SESSION_SECRET`) or a trusted reverse proxy that sets `X-Forwarded-User` plus `MONLET_WEB_TRUST_PROXY_AUTH=true`.
+- [ ] Rate-limit `/login` at the reverse proxy when local web login is enabled.
 - [ ] Set optional `MONLET_NOTIFICATION_TIME_ZONE` for human-readable notifier timestamps.
 - [ ] Browse `/`, `/agents`, `/checks`, `/incidents`, `/events`, `/outbox`.
 - [ ] Verify the web image does not log the token (`docker logs` greps clean).