Release v2.20.1: migrate authentication to Better Auth

docker-compose/README.md

@@ -60,6 +60,8 @@ Key configuration:
 
 - `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`
 - `PULSE_SIGNAGE_SHARED_SECRET`
+- `AUTH_SECRET` (generate with `openssl rand -base64 32` and keep stable across restarts)
+- `AUTH_TRUSTED_ORIGINS` (comma-separated extra browser origins, such as local `localhost` URLs)
 - `WEB_PUBLIC_URL`
 - `BRIDGE_INTERNAL_URL`
 - `DEFAULT_ADMIN_USERNAME`
@@ -129,6 +131,8 @@ Key configuration:
 
 The example files are templates. Copy the appropriate file, review its defaults, and replace secrets or placeholder URLs before deploying.
 
+The local development Compose file reads `docker-compose/.local.env`; set `AUTH_SECRET` there as well. Generate one with `openssl rand -base64 32` and keep it stable across restarts.
+
 ### Public stack: `.env.example`
 
 Use this file as a starting point for the public Compose stack.
@@ -140,6 +144,7 @@ Important values:
 | `PULSE_SIGNAGE_WEB_IMAGE` | Image for the web app and bridge services. | `git.lzstealth.com/lzstealth/pulse-signage-web:latest` |
 | `PULSE_SIGNAGE_PLAYER_IMAGE` | Image for the player services. | `git.lzstealth.com/lzstealth/pulse-signage-player:latest` |
 | `PULSE_SIGNAGE_SHARED_SECRET` | Shared request-signing secret. | Blank; set this for a secured deployment. |
+| `AUTH_SECRET` | Signing/encryption secret for authentication sessions. | Generate with `openssl rand -base64 32`; keep stable across restarts. |
 | `DB_HOST` | MySQL host name. | `mysql` |
 | `DB_PORT` | MySQL port. | `3306` |
 | `DB_NAME` | MySQL database name. | `pulse-signage` |