STARTER_GUIDE.md walkthrough skips sign-in step (Milestone 2 landed after PR #63 was drafted) #166

Context

Found during PR #63 review on 3 Nov 2026.

docs/STARTER_GUIDE.md (added by PR #63) includes a "Your first change: a guided walkthrough" section that starts at step 1 with:

1. Upload a CSV in dynamic mode. Any small CSV works — three columns, a few rows. Drop it on the upload area, preview it, confirm the import.

PR #63 was drafted before ART Milestone 2 (identity and tenancy) landed. Since Milestone 2, signing in is required before a user can reach the upload page. A new reader following step 1 will:

• Load the frontend at http://localhost:8080
• See the sign-in page, not the upload area
• Not know they need to run python scripts\create_tenant_admin.py --tenant dev --name "Dev tenant" --username admin first and then sign in with that account

The pre-sign-in setup is documented in claude/project-status.md ("Running it locally (from Milestone 2 onwards)") and in docs/QUICKSTART.md, but STARTER_GUIDE.md's walkthrough section doesn't mention it.

Proposed

Add a step 0 (or renumber) that says:

0. Create a tenant admin and sign in. The app requires authentication since ART Milestone 2. From the project root, run python scripts\create_tenant_admin.py --tenant dev --name "Dev tenant" --username admin (prompts for a password). Then at http://localhost:8080, sign in as admin with that password. The upload area appears once you're signed in.

Alternative wording: punt to QUICKSTART, something like "Before the walkthrough: follow QUICKSTART's sign-in setup section if you haven't already."

Done when

• Decision taken on inline step vs punt-to-QUICKSTART
• docs/STARTER_GUIDE.md edited accordingly, one small PR
• A reader following the walkthrough from a fresh dev machine can reach the upload page

Related

• PR docs: starter guide #63 adds the file
• Milestone 2 PRs: feat(auth): control schema, local accounts and sign-in sessions (M2a, #92) #98, feat(auth): lock accounts after repeated failed sign-ins (#102) #103, feat(tenancy): route each signed-in request to its tenant's schema (M2b, #93) #100, feat(tenancy): give each tenant its own T&E tables (#99) #104, feat(auth): enforce the role matrix on every data route (M2c, #94) #101, feat(auth): OIDC sign-in against a deployment-controlled IdP (#95) #105, feat(frontend): per-user sign-in; the browser no longer holds the API key (#96) #115, feat(auth): password change, admin reset and break-glass reset (#117) #122 (identity, lockout, tenant routing, tenant T&E tables, roles, OIDC, sign-in page, password management)
• claude/project-status.md section "Running it locally (from Milestone 2 onwards)" — the authoritative current-state reference
• docs/QUICKSTART.md — may also need updating; check whether QUICKSTART covers the sign-in step adequately for the "follow QUICKSTART first" wording