bonfire: document Chromium service-worker login stall

configs/bonfire/README.md

@@ -25,4 +25,26 @@ scripts/bonfire/install-systemd.sh
 Units: `container-koopa-bonfire-db`, `container-koopa-bonfire`, `gitbot-mirror`.  
 Needs `loginctl enable-linger hernani`. Run `podman-compose up -d` once before first boot.
 
-Public feeds: `public-feeds.md`.
+Public feeds: `public-feeds.md`.
+
+## Login in Chromium (PWA service worker)
+
+Firefox and `curl` reach https://bonfire.hacktivism.ch/login (200, real form).  
+**Chromium** (same URL or the yellow **Log in** buttons) can stay on the guest homepage. Not an account/password bug.
+
+Cause (two layers):
+
+1. **Service worker** — Bonfire JS registers `/pwabuilder-sw.js` with `scope: "/"`. An old worker in the Chromium profile intercepts navigations (including `/login`) and serves the cached start page. Firefox typically has no worker → login works there.
+2. **Guest homepage** — static cache / `data-live-socket="false"` plus LiveView `data-phx-link="redirect"` on **Log in**. Without a live socket the click is swallowed. Guest HTML can also leave an empty `modal_invisible` overlay (black panel in Chromium).
+
+Workaround (this Chromium profile):
+
+- `chrome://serviceworker-internals` → **bonfire.hacktivism.ch** → Unregister  
+  or DevTools → Application → Service Workers → Unregister + Clear site data  
+- hard reload, then open `/login`  
+- or **Incognito** (no SW)
+
+Server-side notes (host `~/koopa-bonfire/data/branding/`, not a substitute for unregister): kill-switch `pwabuilder-sw.js`, overlay CSS, login-click JS. Container copies are overwritten on image recreate.
+
+Daylog: `2026/2026-08-17--bonfire-chromium-login.md`.  
+UI badge **Federation disabled** can still show while `.env` has `FEDERATE=true` (see `2026/2026-07-10--bonfire-federate.md`).