6-task plan (T0 branch -> T1 options/roles -> T2 handler -> T3 wiring -> T5 verify; T4 config+docker-dev parallel). AutoLoginAuthenticationHandler registered under the cookie scheme name so existing policies keep working; enabled in docker-dev.