Login feature flag - the rest.

src/server/flags.ts

@@ -0,0 +1,23 @@
+/**
+ * Server feature flags (Decisions.md D-015) — read from the process
+ * environment at startup, so one Docker image serves every configuration
+ * (e.g. `AUTH_ENABLED=false` in docker-compose.yml). The client is never
+ * rebuilt for a flag: it discovers auth availability at runtime from the
+ * `GET /api/auth/me` probe it already makes (404 → feature off).
+ */
+
+/**
+ * Interpret an env-var flag. Unset or empty → `fallback`;
+ * "false", "0", "no", "off" (any case) → false; anything else → true.
+ */
+export function envFlag(value: string | undefined, fallback: boolean): boolean {
+  if (value === undefined || value === "") return fallback;
+  return !["false", "0", "no", "off"].includes(value.toLowerCase());
+}
+
+/**
+ * Login/register (M4): the /api/auth/* endpoints, and thereby the Sign in
+ * UI (src/components/AuthForms.tsx renders nothing when /me 404s).
+ * Enabled by default; set AUTH_ENABLED=false to disable.
+ */
+export const AUTH_ENABLED = envFlag(process.env.AUTH_ENABLED, true);