feat: Phase 11 — CRUD (create/update/delete) + auth + web UI

- Core: createDocument/updateDocument/deleteDocument (file + DB + revision + chunks)
- Parser: stringifyFile (serialize markdown with frontmatter to disk)
- API: tRPC CRUD routers (auth-gated via requireWriteAuth middleware)
- API: createContext now passes expectedSecret from deps (request-scoped auth)
- MCP: 3 new write tools (create_document, update_document, delete_document)
- Web: /create page + ?edit=1 form, /api/auth/login (cookie-based), /api/docs REST CRUD
- Web: Edit buttons on homepage + doc pages (auth-gated)
- Tests: 8 new tests (5 tRPC CRUD + 3 MCP CRUD auth), 40 total all green

packages/config/src/index.ts

@@ -50,6 +50,10 @@ export const QUEUE_PREFIX = process.env.QUEUE_PREFIX ?? "mcpedia";
 // this header (x-webhook-secret) to match, so an open port can't trigger reindex.
 export const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET ?? "";
 
+// Phase 11: Admin password for web-based CRUD (create/update/delete documents).
+// Used by the Web UI login flow. MCP/API writes still use WEBHOOK_SECRET.
+export const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD ?? "";
+
 // NOTE: we deliberately do NOT throw here if DATABASE_URL is empty. Throwing at
 // import time breaks `next build` (SSG data collection imports config before
 // any .env is present) and any runtime-injected env (containers/systemd set env