v0.25.0

docs/API_ACCESS.md

@@ -1,4 +1,4 @@
-# Administration API access - 0.24.10
+# Administration API access - 0.25.0
 
 ## Sign-in boundary
 
@@ -72,9 +72,15 @@ paths instead of browser-side guesses. The object is not available anonymously a
 not expose credentials, environment values, certificate contents or arbitrary filesystem
 listings.
 
-## Swagger UI
+## Docs Reader and API view
 
-`/docs/openapi.json` describes the local endpoints and common request schemas; it
+`/docs` opens an authenticated documentation workspace. The default **Reader** tab loads
+`/docs/content.json`, a build-time bundle of the project Markdown documentation listed in
+`docs/README.md`. The bundle contains documentation source text only; it does not contain
+live configuration, credentials or runtime state. Reader links between bundled Markdown
+documents stay inside the same authenticated documentation surface.
+
+The separate **API** tab uses Swagger UI. `/docs/openapi.json` describes the local endpoints and common request schemas; it
 contains no live configuration, actual credentials, generated keys, user accounts,
 cache entries or listener addresses. Extensible schemas summarize configuration;
 the Rust validator remains authoritative for the full configuration model.
@@ -109,7 +115,7 @@ CLI authority from the local database and calls the guarded loopback administrat
 
 The external validator, query-supplied schema/server configuration and persisted
 Swagger authorization are disabled. Runtime JS/CSS are served from the same admin
-origin behind its guard. Only the two necessary vendor asset filenames and a plain-text license notice
+origin behind its guard. Only the two necessary Swagger vendor asset filenames, the documentation bundle and a plain-text license notice
 (`/docs/licenses.txt`) are routed; all require an administrator session.
 Swagger's inline layout styles have a document-scoped CSP exception; scripts stay
 self-only with no unsafe-eval allowance. The ordinary dashboard CSP is unchanged.