feat(auth): integrate authentication with installation lifecycle

tools/tht/internal/doctor/report.go

@@ -353,7 +353,7 @@ func filePermissions(installation config.Installation) error {
 	return nil
 }
 
-// ValidateVolumes checks the seven persistent volumes required by a ThothII installation.
+// ValidateVolumes checks the eight persistent volumes required by a local ThothII installation.
 func ValidateVolumes(rendered string) error {
 	var document struct {
 		Volumes map[string]json.RawMessage `json:"volumes"`
@@ -361,7 +361,7 @@ func ValidateVolumes(rendered string) error {
 	if err := json.Unmarshal([]byte(rendered), &document); err != nil {
 		return errors.New("Compose returned invalid rendered configuration")
 	}
-	for _, name := range []string{"settings", "pi-state", "workspace-registry", "workspace-secrets", "sessions", "qdrant-data", "embedding-models"} {
+	for _, name := range []string{"settings", "pi-state", "workspace-registry", "workspace-secrets", "sessions", "qdrant-data", "embedding-models", "auth-state"} {
 		if _, exists := document.Volumes[name]; !exists {
 			return fmt.Errorf("rendered Compose configuration is missing required volume %s", name)
 		}