The course gives the address `http://it2810-xx.idi.ntnu.no/project2` and the staff must be able to install and try the project. They should not have to make an account to see the gymnast pages, and they must be able to save and delete things. ### What to do - **A demo coach with example data**, made by a command (`npm run db:demo`). It is a coach of the test login, so it needs no password; the login page has a button for it. It is a normal coach, so it can create and delete gymnasts; the command puts the example data back. - **Delete a gymnast** on the "Your gymnasts" page (`deleteGymnast` exists in the API), with a confirmation that works with the keyboard and a screen reader. - **The test login stays** (it is the only login; accounts with passwords are not planned, see #137), with its guards. On the course server it is turned on on purpose, as `docs/VM_SETUP.md` says. - **Document why:** a new `docs/AUTHENTICATION.md` that says what the course requires, everything we tried before choosing the test login, how it is guarded, what we do not protect on plain http, and what we would do in a real production system (TLS with Let's Encrypt, HSTS, httpOnly cookies, e-mail verification and reset, MFA/passkeys, a check against leaked passwords, limits per IP, Google login). - **Warn on http:** the login page says, when it is served over http (not `localhost`), that it is not encrypted. - `docs/VM_SETUP.md`: the steps on the server. ### Done when - [ ] `npm run db:demo` makes (or resets) the demo coach and its gymnasts, and the README says how to log in as it. - [ ] A coach can delete a gymnast from the page, with a confirmation. - [ ] The http warning shows on a non-`localhost` http page and not on `localhost` or https. - [ ] `docs/AUTHENTICATION.md`, `docs/VM_SETUP.md`, the README and `docs/AI_USAGE.md` are updated.