docs: Casdoor auth guide + README login/known-behavior update

- docs/casdoor-auth.md: addresses and credentials (Casdoor console
  admin/123, seeded users), in-page login flow, status-code table, the
  User/Organization/Role/Permission/Application model, the 9 failure
  scenarios with debug steps, Test 1-6 results, 23-item checklist, and how
  to manage Casdoor (console, seeding, first-admin bootstrap)
- README: replace the 'no authentication' and 'Casdoor not seeded' notes
  with the current login flow, developer-mode toggle and a link to the
  auth guide

README.md

@@ -33,10 +33,11 @@ v1.3/
 ├── README.md
 ├── sql/
 │   └── migration.sql         ← DB schema v2.6 (auto-runs on first boot)
-├── docs/                     ← ERDs + migration plan
+├── docs/                     ← ERDs + migration plan + auth guide
 │   ├── erd.txt               (v2.4 — old procurement schema)
 │   ├── new erd.txt           (v2.5 — material → supplier → category)
 │   ├── NewERD.txt            (v2.6 — integrated procurement + inventory)
+│   ├── casdoor-auth.md       (v2.6 — Casdoor login, roles, failure scenarios)
 │   └── material-supplier-category-migration-plan.md
 ├── backend/                  ← build context of the `api` service
 │   ├── Dockerfile
@@ -69,18 +70,33 @@ v1.3/
 
 ## 🔐 Login
 
-The whole system is behind a login page (`/login`):
+The whole system is behind a login page (`/login`). Login is **in-page**:
+the form (username / password / optional organization) is sent to
+`POST /api/v1/auth/login`; the backend exchanges it with Casdoor
+(password grant), verifies the returned JWT, and starts the session —
+no browser redirect to Casdoor.
 
 - **مدیر پروژه (PM)** → lands in the inventory panel (their project) — can record
   stock changes, manage the project's warehouses and confirm arrivals («کالاهای در راه»).
-- **مدیر تدارکات / ادمین** (the same person) → lands in the procurement office — can manage
+- **مدیر تدارکات / ادمین** → lands in the procurement office — can manage
   quotes, suppliers, projects, and in the inventory panel: dashboard, daily control,
   «کالاهای در راه» (receiving included) and «سازمان‌دهی» (users, PMs, warehouses).
   The «انبارها» and «تغییر موجودی» sections are PM-only.
 
-Until Casdoor is fully seeded, use «ورود آزمایشی (توسعه)» on the login page
-(role + project). Casdoor (org `inventory`, app `inventory-app`) is the planned
-production identity source.
+**Developer Mode** (top-left button on the login page) allows test login as
+مدیر تدارکات / ادمین / مدیر پروژه without Casdoor. It is controlled by the
+`VITE_ENABLE_DEV_LOGIN` env var (in Docker: the `DEV_LOGIN_ENABLED` compose
+build arg, default `true` — set it to `false` for production builds).
+
+| What | Where | Credentials |
+|---|---|---|
+| Casdoor console | http://localhost:8080 | `admin` / `123` |
+| Seeded app users (org `inventory`) | `razaei` (admin), `mousavi` (مدیر تدارکات), `mohaghegh` (مدیر پروژه), `tester` (مدیر پروژه، پروژه «تست») | password `123456` |
+
+Run `backend/tools/seed_casdoor.py` once after the first boot to create the
+Casdoor organization, application and users (idempotent). Full details —
+addresses, credentials, role model, failure scenarios and the checklist —
+are in [`docs/casdoor-auth.md`](docs/casdoor-auth.md).
 
 ---
 
@@ -179,7 +195,12 @@ docker compose down -v              # ⚠️ full reset — wipes DB + MinIO vol
 
 ## Known behavior
 
-- The backend has **no authentication** (dev placeholder) — do not expose to the public internet.
+- Authentication is Casdoor-based (JWT verified via JWKS): `/auth`, `/users`,
+  `/inventory` and `/pm` are protected (401 without a token, 403 without a role).
+  The procurement CRUD endpoints (quotes, suppliers, materials, …) are still
+  open — dev placeholder, do not expose to the public internet.
+- Roles live in the app's `users` table (Casdoor is identity-only): `pm`,
+  `procurement_manager`, `admin`. See `docs/casdoor-auth.md`.
 - Schema runs automatically ONLY on the first boot of an empty `postgres_data` volume
   (see `docker-entrypoint-initdb.d`); the API also runs `CREATE TABLE IF NOT EXISTS`
   for the units-dashboard tables and `quote_attachments` at startup.