Create canonical wiki page Repo README

Repo-README.md

@@ -0,0 +1,94 @@
+<!-- codex-wiki-sync:d5efaa62eaa3add63f853557 -->
+
+> Mirrored from `/mnt/DATA/git/govoplan-access/README.md`.
+> Origin: `repository`.
+> Active tasks and changing state belong in Gitea issues; this wiki page is durable project context.
+
+---
+# GovOPlaN Access
+
+`govoplan-access` is the platform module for GovOPlaN identity,
+authentication, sessions, API keys, RBAC, groups, users, and access
+administration.
+
+The repository contains the extracted access seed implementation under
+`src/govoplan_access/backend`. Session, API-key, and password helper services,
+interactive auth routes, FastAPI auth dependencies, and the legacy
+administration router are owned here. Access-side admin service helpers remain
+here for users, groups, roles, system accounts, sessions, API keys, tenant
+access enforcement, admin/audit lookup capabilities, tenant owner
+provisioning, and governance-template materialization into access-owned groups
+and roles. Governance-template metadata CRUD lives in `govoplan-admin`. The
+transitional administration WebUI route shell and
+access-owned panels live under `webui/src` as `@govoplan/access-webui`. Generic
+system administration panels are contributed by `@govoplan/admin-webui` through
+core's `admin.sections` UI capability. Live access ORM models are defined here
+while retaining their historical table names; tenant records live in
+`govoplan-tenancy`, governance templates in `govoplan-admin`, audit logs in
+`govoplan-audit`, and system settings in `govoplan-core`. The staged
+extraction path is documented in:
+
+- `/mnt/DATA/git/govoplan-core/docs/ACCESS_EXTRACTION_PLAN.md`
+- `/mnt/DATA/git/govoplan-core/docs/MODULE_ARCHITECTURE.md`
+
+## Initial Ownership
+
+This module will own:
+
+- accounts and login identity
+- authentication routes and session lifecycle
+- API keys
+- legacy administration route contribution during the transition
+- tenant-local users
+- groups and memberships
+- roles and role assignments
+- principal resolution
+- permission evaluation
+- access administration backend routes
+- access administration WebUI route contributions
+- published FastAPI auth dependency API
+- access administration, tenant provisioning, and governance materializer
+  capabilities
+- access-owned migrations
+
+The governance-template routes under `/admin/system/governance-templates` are
+contributed by `govoplan-admin`; access must not register those routes.
+
+`govoplan-access` depends on `govoplan-tenancy`; the registry loads tenancy
+before access for authenticated platform composition.
+
+## WebUI Package
+
+The repository root and `webui/` directory both expose the package
+`@govoplan/access-webui`. The package contributes the `/admin` route and admin
+nav item through core's module WebUI contract. The route shell consumes
+module-owned `admin.sections` contributions from installed platform modules and
+continues to render access-owned tenant/user/group/role panels locally. Core
+supplies shared admin components, route rendering, and icon resolution.
+
+The kernel remains responsible for module discovery, route aggregation,
+database/session lifecycle, migration orchestration, capability registry, and
+stable contracts.
+
+## Gitea Workflow
+
+This repository uses the shared GovOPlaN Gitea issue workflow. Issue templates
+are installed under `.gitea/`, and the shared label taxonomy is copied to
+`docs/gitea-labels.json`.
+
+From the core checkout, labels can be synced once a local `GITEA_TOKEN` is
+available:
+
+```bash
+cd /mnt/DATA/git/govoplan-core
+./scripts/gitea-sync-labels.py --root /mnt/DATA/git/govoplan-access --apply
+```
+
+## Development Install
+
+From the core checkout:
+
+```bash
+cd /mnt/DATA/git/govoplan-core
+./.venv/bin/python -m pip install -e ../govoplan-access
+```