fix: make worker handoff rotation durable

deploy/orchestra.env.example

@@ -36,6 +36,14 @@ ORCHESTRA_WORKTREE_ROOT=/var/lib/orchestra/worktrees
 
 # Hard rotation occupancy threshold (0 < x < 1). Default 0.75 if unset/invalid.
 ORCHESTRA_OCCUPANCY_HARD=0.75
+# Advisory handoff threshold and the harness context window used to turn
+# per-session token counts into occupancy. Both values are worker-local.
+ORCHESTRA_OCCUPANCY_SOFT=0.55
+ORCHESTRA_CONTEXT_WINDOW=200000
+# OpenCode stores per-session token counters in SQLite. This optional override
+# must point at the worker-local database; the worker persists the resolved
+# session ID for each lease, never "the latest" session.
+#ORCHESTRA_OPENCODE_DB=/home/orchestra/.local/share/opencode/opencode.db
 
 # --- Providers ---
 # Local JSONL task ingestion (baseline adapter).
@@ -74,10 +82,12 @@ ORCHESTRA_OCCUPANCY_HARD=0.75
 # --- Bus authorization tokens (bearer auth per surface; a surface with no
 # token set has no auth requirement — set these once you have real clients) ---
 #ORCHESTRA_TUI_TOKEN=
-# Required: the service refuses to start without it. It gates the web UI's
-# task, lifecycle and approval controls, and it is also the token for any
-# /v1/ caller that does not declare a surface (they default to Web).
-ORCHESTRA_WEB_TOKEN=
+# Required: the service refuses to start without both. The browser UI's
+# task, lifecycle and approval controls are session-gated; it no longer
+# accepts a shared Web bearer token. Generate the bcrypt hash with:
+#   go run ./cmd/orchestra-password
+ORCHESTRA_WEB_USERNAME=operator
+ORCHESTRA_WEB_PASSWORD_HASH=
 # Set when the UI is served over plain HTTP, so the session cookie can be
 # sent without Secure. Leave unset behind TLS.
 #ORCHESTRA_UI_INSECURE_COOKIE=1