Improving Win95 styling

DEPLOY.md

@@ -1,6 +1,6 @@
 # Deploy CA Lab Studio
 
-Deploy `glitch_voxel_automata_lab`, not `glitch_voxel_automata`.
+Deploy this CA Lab Studio app into `/opt/glitch_automata_lab` on the server.
 
 This app is the CA Lab Studio service:
 
@@ -8,6 +8,42 @@ This app is the CA Lab Studio service:
 - React admin app at `/admin`
 - React viewer/recorder routes at `/view/*`
 - Postgres database via `DATABASE_URL`
+- Cross-subdomain lab access via the shared gnommoweb `auth_token` JWT cookie
+
+## Lab Access
+
+In production, the lab expects gnommoweb to be the identity issuer:
+
+```env
+JWT_SECRET=...                         # same value as gnommoweb
+LAB_AUTH_ENABLED=true
+LAB_KEYCARD_REQUIRED=true
+GNOMMOWEB_URL=https://glitch.university
+LAB_KEYCARD_MERIT_SLUG=lab-keycard
+LAB_USER_PROFILE_URL=https://glitch.university/api/user/profile
+LAB_SIGN_IN_URL=https://glitch.university/auth/google?returnTo={returnTo}
+```
+
+The gnommoweb side should set `auth_token` with `Domain=.glitch.university`
+and expose `LAB_USER_PROFILE_URL`. Access is granted immediately if the verified
+JWT contains:
+
+```json
+{ "merit_slug": "lab-keycard" }
+```
+
+If the JWT does not contain that claim, the lab calls the user profile endpoint
+with the same `auth_token` cookie and expects the profile to include:
+
+```json
+{
+  "merits": [
+    { "slug": "lab-keycard" }
+  ]
+}
+```
+
+Local development keeps auth disabled unless `LAB_AUTH_ENABLED=true` is set.
 
 ## Build