Update docs/build-notes.md

Update build notes for authentication milestone

docs/build-notes.md

@@ -44,18 +44,22 @@
 
 ### Milestone 4 — Authentication and access control
 
-- Add password authentication for the Munin web interface
+- Add user authentication for the Munin web interface
-- Require authentication before accessing the status API
+- Require authentication before accessing wallet and monitoring data
-- Store the configured admin password through the StartOS package configuration
+- Add password management through StartOS `Actions & Config`
-- Pass the configured admin password to the service through `MUNIN_ADMIN_PASSWORD`
+- Store the Munin admin password in the persistent StartOS `main` volume
-- Create cryptographically random session tokens
+- Pass the stored admin password to the Munin container through `MUNIN_ADMIN_PASSWORD`
-- Store active sessions in memory with a 24-hour expiration
+- Protect the status API from unauthenticated access
-- Protect sessions with an `HttpOnly`, `Secure`, `SameSite=Strict` cookie
+- Use secure, HTTP-only, SameSite session cookies
-- Compare passwords using a timing-safe comparison
+- Use cryptographically random session tokens
-- Return HTTP 401 when the status API is accessed without a valid session
+- Use constant-time password comparison
-- Provide a web login form for authentication
+- Expire sessions after 24 hours
-- Verify successful login and authenticated status API access on the physical StartOS server
+- Clean up expired sessions periodically
-- Verify the authentication-protected S9PK package contains the authentication backend and updated web interface
+- Display a login form in the web interface
+- Display authentication errors in the web interface
+- Verify authentication on the physical StartOS server
+- Verify that the configured password survives a package update
+- Verify that authenticated access to the status API continues to work after the package update
 
 ## Current architecture
 
@@ -64,11 +68,12 @@
 - nginx serving the web interface
 - Node.js status API
 - Static dashboard in `web/index.html`
-- Password authentication and session handling in `server/auth.js`
 - Fulcrum provided as a StartOS dependency
 - Electrum protocol connectivity check from Munin to Fulcrum
 - Blockchain height queried through Fulcrum
-- Admin password provided to the service through the StartOS package environment
+- StartOS `main` volume used for persistent Munin data
+- Admin password stored persistently in the StartOS `main` volume
+- Session-based authentication for the web interface
 
 ## Current status
 
@@ -76,9 +81,11 @@ Munin Bitcoin is running as a StartOS service and can verify connectivity to the
 
 Munin can query the current Bitcoin blockchain height through Fulcrum.
 
-The Munin web interface now requires password authentication before the protected status API can be accessed.
+The Munin web interface is protected by password authentication.
 
-Authenticated sessions use a temporary in-memory session token with a 24-hour lifetime.
+The admin password can be configured through StartOS `Actions & Config` and is stored in the persistent `main` volume so that it survives package updates.
+
+Authentication and password persistence have been verified on the physical StartOS server, including verification that an existing password remains valid after a package update.
 
 Bitcoin Core RPC is not currently used by Munin.