Docs: username and password sign-in for live badges

src/content/docs/docs/badges.md

@@ -30,6 +30,8 @@ Badge colours are Accent, Success, Warning, Danger and Info. Each is drawn for t
 
 A number from any API. Enter the API URL, add a header if the API needs a key, and press <span class="sy-btn sy-btn--ghost">Fetch</span>. Stackyard lists every number in the response. Pick one.
 
+If the API asks for a username and password, turn on **Authentication** and enter them under **Sign In**. The password stays on the server. A username and password typed into the URL are not sent.
+
 Tick **Secret** on a header to keep its value on the server. Poll sets how often it reads, in seconds. Every open dashboard shares that reading.
 
 ### More than one value

src/content/docs/docs/security.md

@@ -41,7 +41,7 @@ Stackyard never adds a name to the list by itself. Open a fresh install by its I
 
 Stored secrets are stripped from the config before it reaches the browser. A populated field reports as set without returning its value, in config responses and in exports alike.
 
-A secret is restored only for the request it was stored for. If a save changes where the credential would be sent, by editing a badge URL, its non-secret headers, or a widget field that decides where it goes, the stored value is not restored and Stackyard names what must be re-entered. Matching on an item's id alone would let an imported config point an existing credential somewhere new. These count as such a change too: turning **Allow self-signed certificate** on or off for an app, turning `settings.server.skipTlsVerify` on or off for widgets, changing a widget's type, and changing or removing the port map (`settings.server.portMap`).
+A secret is restored only for the request it was stored for. If a save changes where the credential would be sent, by editing a badge URL, its non-secret headers, its sign-in username, or a widget field that decides where it goes, the stored value is not restored and Stackyard names what must be re-entered. Matching on an item's id alone would let an imported config point an existing credential somewhere new. These count as such a change too: turning **Allow self-signed certificate** on or off for an app, turning `settings.server.skipTlsVerify` on or off for widgets, changing a widget's type, and changing or removing the port map (`settings.server.portMap`).
 
 Secrets are stored in plain text in `apps.json` on the data volume. Protect that volume with filesystem permissions and backups.
 

src/content/docs/docs/troubleshooting.md

@@ -99,7 +99,7 @@ Check that the service is reachable and the credential is still valid.
 
 ### A credential stopped working after an edit
 
-Changing where or how a credential would be sent clears the stored value. Editing a badge URL, its non-secret headers, or a widget field that decides where the credential goes all count. Display settings such as units, colours and links do not. These count too: turning **Allow self-signed certificate** on or off for an app, and in the config, turning `settings.server.skipTlsVerify` on or off or changing or removing the port map (`settings.server.portMap`). Unticking **Secret** on a header row clears it on the next save.
+Changing where or how a credential would be sent clears the stored value. Editing a badge URL, its non-secret headers, its sign-in username, or a widget field that decides where the credential goes all count. Display settings such as units, colours and links do not. These count too: turning **Allow self-signed certificate** on or off for an app, and in the config, turning `settings.server.skipTlsVerify` on or off or changing or removing the port map (`settings.server.portMap`). Unticking **Secret** on a header row clears it on the next save.
 
 Stackyard names the items to re-enter. Enter the credential again and save.
 
@@ -268,6 +268,7 @@ Messages shown in the admin, and what each one means.
 | `Settings unavailable` | The widget's definition could not be loaded. The stored config is kept. |
 | `N widgets could not be loaded, so they are not listed below.` | Those definitions were refused at startup. The reason is in the container log. |
 | `Container not found` | The socket proxy answered, but no container matched that name. |
+| `Enter the username and password under Sign In. A login in the URL is not sent.` | The Live Activity URL holds a username or password before the host. Stackyard does not send it. Enter them under Authentication, Sign In. |
 | `This address has no API path. Enter the service's full API URL.` | The Live Activity address names a host only. Badges read a value from an API response, so the address needs the service's API path. |
 | `Connected, but this address has no API path. Enter the service's full API URL.` | The address answered, but nothing numeric was found in the response. Same cause as above. |
 | `The address answered with a redirect (HTTP <status>). Enter the address it points to.` | Redirects are not followed. Use the final address, which is often a login page when the API path is missing. |