feat: deliver authenticated merchant analytics API

README.md

@@ -2,7 +2,27 @@
 
 Go backend for merchant identity, dataset ingestion, deterministic analytics, authenticated APIs, and later AvalAI integration.
 
-Current state: specifications, architecture, implementation plan, and task list are approved. Phase 4 implementation is authorized; the Go scaffold begins with Task F1.
+Current state: the local MVP implements database migration, streaming dataset import,
+secure demo identity, deterministic dashboard analytics, merchant-scoped details/CSV,
+the authenticated HTTP API, and a Redis-connected worker boundary.
+
+## Local development
+
+Copy `.env.example` to the ignored `.env`, load its variables in your shell, and run:
+
+```text
+go run ./cmd/migrate
+go run ./cmd/importer
+go run ./cmd/admin
+go run ./cmd/worker
+go run ./cmd/api
+```
+
+`cmd/admin` idempotently creates or resets `DEMO_USERNAME` using `DEMO_PASSWORD`
+and assigns it to the imported merchant with the largest session population. It
+never prints the password or stores it outside the Argon2id hash. The local API
+uses the `zpa_session` HttpOnly cookie when `COOKIE_SECURE=false`; secure
+deployments use the contract's `__Host-zpa_session` cookie.
 
 ## Local dataset input