docs(mealie): note port 9090 trade-off and who gets in

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mealie/CHANGELOG.md

@@ -2,6 +2,7 @@
 ## v3.29.0.1 (2026-10-25)
 - New option `login_with_ha_user` (on by default): the Ingress panel logs in as the Mealie user matching your Home Assistant username, through Mealie's reverse proxy auth. Unmatched users get the normal login page
 - Only the ingress server can use it: it sends Mealie a per-boot shared secret (`REVERSE_PROXY_AUTH_SECRET`), and the ingress listener now accepts only the Supervisor
+- Reverse proxy auth through the direct web port is no longer possible: a proxy you run in front of port 9090 cannot send the per-boot secret. Set `login_with_ha_user: false` and configure it yourself through `env_vars` if you need that
 
 ## v3.29.0 (2026-10-24)
 - README: document logging in with the Home Assistant user through Ingress (reverse proxy auth)

mealie/README.md

@@ -91,6 +91,7 @@ With `login_with_ha_user` (on by default), the Ingress panel signs you in automa
 
 - If no Mealie user has that username, the normal login page is shown. To create the user automatically instead, add `REVERSE_PROXY_AUTH_SIGNUP_ENABLED` with value `true` to the `env_vars` option.
 - Matching ignores case, and also accepts the Mealie user's email.
+- Any Home Assistant user who can open the panel gets the matching Mealie account, admins included.
 - Only Ingress can log in this way: it sends Mealie a secret generated at each start, so requests through the direct web port (9090 by default) always get the normal Mealie login.
 - Set `login_with_ha_user: false` to turn it off.