final touches for beta skymoney (at least i think)

api/openapi.yaml

@@ -4,8 +4,9 @@ info:
   version: 0.1.0
   description: |
     Fastify backend for budgeting/allocations.
-    Most endpoints accept an optional `x-user-id` header; when omitted, the server
-    defaults to `demo-user-1`.
+    Authentication uses secure httpOnly session cookies (Fastify JWT). During tests
+    or local development you can set `AUTH_DISABLED=1` to use the legacy `x-user-id`
+    header for impersonation, but production relies on the session cookie.
 
 servers:
   - url: http://localhost:8080
@@ -323,6 +324,9 @@ components:
       in: header
       name: x-user-id
       required: false
+      description: |
+        Dev/test-only tenant selector when AUTH_DISABLED=1. Production requests rely
+        on the session cookie instead and should omit this header.
       schema: { type: string }
       description: Override the stubbed user id for the request.
     RequestId: