docs: update documentation to OKF v0.1 format

docs/api/rest-overview.md

@@ -3,7 +3,7 @@ type: api
 title: REST API Overview
 description: Base URL, versioning, auth, CSRF, and the standard error envelope.
 tags: [api, rest, overview, csrf]
-timestamp: 2026-07-21T14:43:00Z
+timestamp: 2026-07-21T18:28:00Z
 ---
 
 # Base URL & versioning
@@ -40,8 +40,11 @@ prefix; the SPA fallback only kicks in for non-API routes.
 * Skip list (`SKIP_PATH_PREFIXES` in
   `backend/src/common/middleware/csrf.middleware.ts`):
   - `/api/v1/auth/register-first-admin`
-  - `/api/v1/auth/login`
   - `/api/v1/setup/create-admin`
+  - `/api/v1/auth/login` is **no longer** skipped — the middleware still
+    mints the cookie on the first response, and the SPA's
+    `AuthService.login`/`AuthService.register` first call `GET /api/v1/auth/csrf`
+    via `ensureCsrf()` to materialise the cookie before submitting.
 
 # Error envelope
 
@@ -73,7 +76,8 @@ endpoint). Full list lives in `backend/src/common/errors/error-codes.ts`:
 `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`,
 `CONFLICT`, `LAST_ADMIN`, `SYSTEM_INITIALIZED`, `RATE_LIMITED`,
 `CSRF_INVALID`, `WEAK_PASSWORD`, `USERNAME_TAKEN`,
-`INVALID_CREDENTIALS`, `TOKEN_REVOKED`, `THEME_INVALID`, `INTERNAL`.
+`INVALID_CREDENTIALS`, `TOKEN_REVOKED`, `THEME_INVALID`,
+`REGISTRATIONS_DISABLED`, `INTERNAL`.
 
 # See also