Deploy OpenWebUI update from local

README.md

@@ -10,9 +10,30 @@ pinned: false
 
 # Montaigne OpenWebUI
 
-OpenWebUI deployment for the Montaigne chatbot.
+**This Space is the production user interface of the Montaigne chatbot.**
 
-This Space connects to the Montaigne FastAPI backend through an OpenAI-compatible API exposed at `/v1`.
+`https://ask-montaigne.pages.dev` redirects here; the admin dashboard (backend
+user management) lives at `https://ask-montaigne.pages.dev/admin.html` and uses
+its own cookie/CSRF auth.
+
+The Space connects to the Montaigne FastAPI backend through an
+OpenAI-compatible API exposed at `/v1`.
+
+## Auth Model
+
+OpenWebUI runs with authentication **disabled** (guest-only, `features.auth=false`):
+
+- Anonymous visitors are mapped to per-IP backend guest accounts with a
+  **5-message limit** per IP.
+- At the limit, the UI patch shows a "Create free account" modal
+  (`POST /auth/claim-guest`), which creates a backend account and sets its
+  password at claim time.
+- The account token rides on `/v1` requests as `variables.montaigne_token`;
+  conversation continuity is keyed by `X-OpenWebUI-Chat-Id` / browser
+  fingerprint.
+- There are **no OpenWebUI accounts, no billing, no conversation sharing, and
+  no OAuth buttons** in the UI. The backend `/auth/profile` and `/billing/*`
+  endpoints stay dormant.
 
 ## UI Policy (Minimal Consumer Interface)
 
@@ -28,7 +49,8 @@ This is enforced in two layers:
 2. **Runtime DOM patch** — `config/minimal_ui_patch.js` is copied into the
    built OpenWebUI app and injected into `index.html` at container startup.
    It hides the model selector, settings entry, archived chats, keyboard
-   shortcuts, and other power-user affordances from the public UI.
+   shortcuts, and other power-user affordances from the public UI, and
+   implements the guest-limit claim modal.
 
 ### Updating the policy