CI / typecheck + build (turbo) (push) Canceled after 0s
Web UI login sets mcpedia_admin cookie; /api/docs/route.ts required the x-webhook-secret header which the browser form also sends, but the dual-auth path was brittle. Now accepts either: header (API/MCP style) OR cookie (web login). Also set ADMIN_PASSWORD on VPS .env and restart web.