docs(site): correct stale "no authentication" security warnings

Auth is opt-in (-auth) since the accounts + RBAC feature shipped, so the
absolute "Mahresources has no authentication" claims were false.

- Announcement bar: reword to "off by default (opt-in via -auth)", keep
  the reverse-proxy advice, link to the Authentication & RBAC page
- Reword the No-Authentication danger admonitions in api/overview,
  getting-started/installation, and deployment/docker to "off by default"
  with a pointer to the opt-in feature
- Add CSS so the banner link and -auth code chip stay high-contrast
  (white + underline) on the red background

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: egeozcan

docs-site/docs/api/overview.md

@@ -6,9 +6,9 @@ sidebar_position: 1
 
 All features are accessible via a REST API. Most write endpoints accept either JSON or form-encoded requests, and most `/v1` endpoints return JSON.
 
-:::danger No Authentication
+:::danger Authentication is off by default
 
-There is no authentication or authorization. The API is designed for use on private, trusted networks only. **Never expose the server directly to the public internet.**
+Out of the box the API has no authentication or authorization, so it is designed for private, trusted networks only. **Never expose the server directly to the public internet.** Opt-in [Authentication & RBAC](../features/authentication.md) (`-auth`) adds per-user accounts, roles, and API tokens (`Authorization: Bearer <token>`); even then, front the server with a reverse proxy for internet-facing deployments.
 
 :::
 

docs-site/docs/deployment/docker.md

@@ -7,7 +7,7 @@ description: Running Mahresources in Docker containers
 # Docker Deployment
 
 :::danger Security Warning
-There is **no built-in authentication**. Never expose Docker containers directly to the internet. Always use a reverse proxy with authentication. See [Reverse Proxy](./reverse-proxy.md) for setup instructions.
+Authentication is **off by default**. Never expose Docker containers directly to the internet -- always use a reverse proxy with authentication. See [Reverse Proxy](./reverse-proxy.md) for setup instructions. Built-in [Authentication & RBAC](../features/authentication.md) (`-auth`) adds per-user accounts on top.
 :::
 
 ## Building the Image

docs-site/docs/getting-started/installation.md

@@ -6,7 +6,7 @@ sidebar_position: 1
 
 :::danger Security Warning
 
-There is **no built-in authentication**. Never expose the server directly to the public internet. Always run it on a private network or behind a reverse proxy with proper authentication.
+Authentication is **off by default**. Never expose the server directly to the public internet -- run it on a private network or behind a reverse proxy with authentication. Built-in [Authentication & RBAC](../features/authentication.md) is available (opt-in via `-auth`) when you need per-user accounts and roles.
 
 :::
 

docs-site/docusaurus.config.ts

@@ -54,7 +54,7 @@ const config: Config = {
     },
     announcementBar: {
       id: 'security_warning',
-      content: '⚠️ <strong>Security Notice:</strong> Mahresources has no authentication. Only run on trusted private networks.',
+      content: '⚠️ <strong>Security Notice:</strong> Authentication is off by default (opt-in via <code>-auth</code>). Never expose Mahresources to the internet without a reverse proxy. <a href="/mahresources/features/authentication">Learn more</a>.',
       backgroundColor: '#dc2626',
       textColor: '#ffffff',
       isCloseable: false,

docs-site/src/css/custom.css

@@ -17,6 +17,21 @@
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.1);
 }
 
+/* Keep the security-notice announcement bar link and inline code readable on
+   its red background (white text + underline, never the low-contrast blue link
+   color). The class names are CSS-module-hashed, so target by prefix. */
+div[class^='announcementBar_'] a,
+div[class*=' announcementBar_'] a {
+  color: inherit;
+  text-decoration: underline;
+}
+div[class^='announcementBar_'] code,
+div[class*=' announcementBar_'] code {
+  color: inherit;
+  background-color: rgba(255, 255, 255, 0.2);
+  border-color: rgba(255, 255, 255, 0.4);
+}
+
 /* For readability concerns, you should choose a lighter palette in dark mode. */
 [data-theme='dark'] {
   --ifm-color-primary: #25c2a0;