docs: add api.md contract for sprint 1 + update changelog

- docs/api.md: contract the frontend consumes — base URL, auth transport
  (Flask session cookie, credentials: include), uniform error envelope,
  MA6 tenant-scope behaviour (404 not 403), per-endpoint shape for
  /auth/{login,logout,me} and /engagements GET/POST/GET-by-id, plus a
  worked example walking through CLI bootstrap → login → POST engagement →
  list → logout.
- CHANGELOG.md: sprint-1 entry summarising the three endpoints, the dev-
  only CORS, the AuthUser extension, the audit rows, and the test
  coverage.

CHANGELOG.md

@@ -5,6 +5,35 @@ Versioning starts at `0.1.0` when sprint 0 lands.
 
 ## [Unreleased]
 
+### Sprint 1 — backend auth wiring (`feature/backend-auth-wiring`)
+
+- **`POST /api/v1/auth/login`** — local-credentials login. Body `{username,
+  password}`; success returns the `CurrentUser` shape (`user_id`, `username`,
+  `display_name`, `role`, `permissions`, `groups`) and sets a Flask session
+  cookie. Failures return a uniform `401 invalid_credentials` envelope; a
+  bcrypt round runs against a dummy hash on unknown users to flatten the
+  timing signal.
+- **`POST /api/v1/auth/logout`** — clears the session, returns `204`. Writes
+  an `auth.logout` audit row.
+- **`GET /api/v1/auth/me`** — rehydrates the frontend at boot; returns the
+  current principal or `401 not_authenticated`.
+- **Error envelope** — every API failure now returns
+  `{error: "<code>", message: "<human>"}`. `LoginManager.unauthorized_handler`
+  is wired to the same shape so `@login_required` 401s match.
+- **Dev-only CORS** — `flask-cors` wraps `/api/*` for the origins in
+  `MIMIC_CORS_ORIGINS` only when `MIMIC_ENV=development`. Prod keeps
+  same-origin via the reverse proxy.
+- **`AuthUser` extended** — carries `display_name` + `user_type` so the
+  serialiser can return them.
+- **Audit** — `auth.login` and `auth.logout` rows go through the existing
+  hash-chained writer.
+- **Docs** — `docs/api.md` describes the contract the frontend consumes
+  (login flow, CurrentUser shape, error envelope, MA6 tenant-scope behaviour).
+- **Tests** — 5 unit tests on the schemas + serializer; integration scaffold
+  test `tests/integration/test_auth_engagement_e2e.py` exercises the full
+  login → /me → POST engagement → list → logout loop on a testcontainers
+  Postgres.
+
 ### Team decisions (2026-05-21)
 
 - **Q1** — SOC client collaboration in the live cockpit is assumed valid (no PoC sheet).