Add Authentik Git login helper

README.md

@@ -53,6 +53,7 @@ TARGET_DIR=~/work/rta-handbook \
 ## Daily Flow
 
 ```sh
+section0-docs auth login
 section0-docs doctor
 section0-docs pull
 
@@ -69,16 +70,20 @@ the lab operator side; collaborators do not need the home-lab repo.
 
 ## Contributor Setup
 
-Anonymous clone/read works on the private lab network. Pushing requires an
-account or access token with write access to `section0/rta-handbook`.
+Anonymous clone/read works on the private lab network. Pushing requires
+Authentik login through the helper.
 
 Run this once per checkout:
 
 ```sh
-section0-docs configure
+section0-docs auth login
 ```
 
-Then prove write access without changing `main`:
+The login opens Authentik in your browser, configures the Git author from your
+identity, and installs the repo Git credential. After that, normal Git tooling
+works too.
+
+Prove write access without changing `main`:
 
 ```sh
 section0-docs push-test
@@ -87,7 +92,8 @@ section0-docs push-test
 `push-test` does not commit files and does not change `main`. It pushes the
 current commit to a temporary scratch branch, then deletes that branch
 immediately. If Git prompts for a password, use a Gitea access token rather
-than your normal account password.
+than your normal account password. If login is healthy, Git should usually get
+the credential from your local credential store.
 
 ## End-To-End Smoke Test