add auth

.env.example

@@ -27,6 +27,23 @@ SCHEDULER_ENABLED=true
 TELEGRAM_BOT_ENABLED=true
 LOG_LEVEL=INFO
 
+# ---- web login (closes the browser UI to everyone but you) -----------------
+# Unset: the browser UI is as open as the API ("off by default" above). Set
+# either of these and the login screen appears — the desktop app is untouched,
+# it keeps using API_TOKEN.
+#
+# Password: set once, seeds a hash into the DB on first boot; from then on
+# change it in Settings -> Access or with `make set-password` on the server.
+AUTH_USERNAME=timka
+AUTH_PASSWORD=
+#
+# Telegram login (the "Login Widget", not the bot): needs TELEGRAM_BOT_TOKEN
+# above, this site's HTTPS domain registered with @BotFather via /setdomain,
+# and your numeric Telegram user id (DM @userinfobot to get it — it is not
+# the same as TELEGRAM_CHAT_ID when that is a group).
+TELEGRAM_OWNER_ID=
+TELEGRAM_BOT_USERNAME=
+
 # ---- Jira (required for the Jira source) -----------------------------------
 JIRA_BASE_URL=https://your-site.atlassian.net
 JIRA_EMAIL=you@example.com