docs: record UniFi SSO login change and Ansible management (W1N-51)

docs/unifi-network.md

@@ -13,6 +13,32 @@
 Although `8080` is a common UniFi inform port, this controller uses `9080`.
 All AP adoption and recovery procedures must use the endpoint above.
 
+## Login and MFA
+
+On 2026-08-08, **"Sync Local Admin with Ubiquiti SSO"** was disabled
+(`super_sdn.sso_login_enabled: false`). Previously every login was forced
+through Ubiquiti SSO (sso.ui.com) and required MFA, which blocked programmatic
+access: the `unifi-network-mcp` write operations failed with
+`api.err.Ubic2faTokenRequired`.
+
+Now local accounts (`windy`, `zhiqiangf`) sign in with their local passwords
+and no MFA. The `unifi-network-mcp` tool uses the `zhiqiangf` local account and
+works for both read and write operations (verified 2026-08-08 with a reversible
+client rename).
+
+Impact: unifi.ui.com remote access (Site Manager) no longer works.
+
+Manage the setting idempotently via Ansible:
+
+```bash
+cd ansible
+ansible-playbook playbooks/unifi-sso.yml --limit unifi --check   # read-only
+ansible-playbook playbooks/unifi-sso.yml --limit unifi \
+  -e '{"unifi_sso_confirm": true, "unifi_sso_target_value": false}'  # apply
+```
+
+See [runbooks/ansible-operations.md](../runbooks/ansible-operations.md).
+
 ## Inter-VLAN reachability
 
 The AP management networks are routed by [gw](../hosts/gw.md),