docs: document full and embedded rendering with server authentication

docs/install/authentication-local.md

@@ -1,6 +1,11 @@
 # Local authentication
 
-Use local mode for a standalone PC or Mac. Configure it through `tht`; passwords are entered at an
+Use local mode for a standalone PC or Mac, with `shell.mode: full` and
+`shell.defaultLocale: en` in the installation descriptor. Presentation and
+authentication are independent: selecting full does not create accounts. Omics
+embedded instead uses the [upstream guide](authentication-upstream.md), not local users.
+
+Configure local authentication through `tht`; passwords are entered at an
 echo-free prompt or read from a protected `--password-file`, never from a command argument.
 
 ## Bootstrap
@@ -56,6 +61,11 @@ machine use; JSON output is pristine on stdout.
 
 ## Session behavior and recovery
 
+Full shows its own login form and, after login, the verified display name in its
+header. The name menu contains Log out. This sends a CSRF-protected request to
+`/api/auth/logout`, revokes the session and returns to login. Language/theme
+preferences may remain in the browser; they are not credentials.
+
 An ordinary login expires after 2 hours idle or 12 hours absolute. Selecting **Remember me** makes
 the cookie persistent and changes the limits to 7 days idle or 30 days absolute. Remembered
 sessions survive a browser and backend restart, but not a user revision change, configuration