docs: describe React dashboard migration state

docs/api.md

@@ -27,22 +27,21 @@ The RedditBot web dashboard exposes a REST API for monitoring and controlling th
 
 **Content-Type**: `application/json` (except SSE)  
 **Response Format**: JSON  
-**Authentication**: Dashboard session cookie or bearer token
+**Authentication**: Required for cutover; not yet enforced by the checked-in Express host
 
 ---
 
 ## Authentication
 
-The dashboard, API, SSE streams, and private media require the token configured
-through `WEB_DASHBOARD_TOKEN` (preferred) or `web.authToken`. Interactive users
-exchange the token for an HttpOnly, SameSite=Strict session cookie at
-`POST /auth/session`. API clients may instead send
-`Authorization: Bearer <token>`.
+The React cutover requires a single Express authentication boundary covering
+the dashboard assets, `/api`, both SSE streams, debug routes, and private media.
+That boundary and its token/session configuration are not present in the
+checked-in server yet. Until they land and their security tests pass, bind the
+dashboard to a trusted network and do not expose port 3000 publicly.
 
-`GET /auth/login` and `POST /auth/session` are the only unauthenticated
-dashboard routes. A rejected API request returns HTTP 401 with
-`{"error":"Dashboard authentication required"}`. Debug endpoints are absent
-unless `web.debugEnabled` is explicitly enabled.
+The intended contract is an HttpOnly, SameSite=Strict dashboard session for
+interactive users and bearer-token access for API clients. Treat those details
+as a migration requirement, not as proof of current protection.
 
 ---
 
@@ -1001,7 +1000,8 @@ the complete validated event envelope:
 
 Clients may reconnect with `Last-Event-ID`; the server replays retained events
 after that ID in order. The stream sends heartbeats, bounds buffered events and
-slow-client queues, and requires the same dashboard authentication as the API.
+slow-client queues. Applying the same authentication boundary as the API is a
+pending cutover gate.
 
 Current event families include bot status, message sent or failed,
 conversation updated, reply received, sync lifecycle and progress, rate-limit