v1.21.0 — HTTP Basic Auth, guide hygiene, and four new demonstration cases

Highlights

• --http-credentials — Diwall now answers HTTP Basic Auth (RFC 7617),
  the network-level challenge a reverse proxy (Caddy, nginx, Traefik) raises
  in front of self-hosted admin interfaces — a common pattern in
  self-hosting that Diwall's form-based vault mechanism didn't cover until
  now. Credentials are resolved from the vault and scoped to the target's
  origin — never sent to a third-party origin loaded in the same browser
  context. Confirmed against a real Basic Auth–protected target, not just a
  synthetic fixture.
• docs/GUIDE_LLM.md back under its own budget — compressed from 413
  to 250 lines, the limit CLAUDE.md had promised but silently exceeded
  across several prior releases. A length check now runs as part of
  scripts/verifier-coherence.sh to prevent the drift from recurring.
• Non-presumption rule — a model must never assert that a Diwall
  capability is absent, and must never presume one exists, without
  checking the documentation first.
• Four new demonstration cases in docs/GUIDE.md — self-hosted
  observability/analytics dashboards, ticketing platform administration,
  local events tracking, and honest e-commerce access data under Citizen
  Navigation. Tools and platforms are described by functional category
  rather than named, so the examples stay usable as prompt templates
  regardless of which specific product a reader is running.

Fixed

• --secrets vault-file resolution: dedicated http_username/
  http_password keys are tried first, falling back to the plain
  username/password pair already used by most existing vault files —
  found during real-target validation.
• A stale claim in the documentation stated --secrets could be passed
  multiple times to combine several vaults; it cannot (single value,
  last one silently wins) — corrected.
• A vault-file naming assumption (filename derived from the target's
  hostname) was clarified: with --secrets, the filename is whatever the
  operator chose, never hostname-derived.
• The .deb package never shipped scenarios/diagnostic_dom.json or
  scenarios/test_stealth.json, even though the operational manual and
  two notices reference them directly — found via a full clean-install
  test, not just an upgrade test.

Also in this release

• scenarios/interoperabilite/ gained a local, deterministic Basic Auth
  fixture (a minimal server issuing a real 401 challenge) as a permanent
  regression fixture.
• docs/RETOUR_EXPERIENCE.md, docs/MANUEL.md, docs/FAQ_LLM.md, and
  README.md updated for completeness alongside the new capability.