feat(auth): frontend login/setup pages + auth state in App.jsx

frontend/src/api.js

@@ -68,3 +68,54 @@ export async function submitCapture(archiveId, locator) {
     throw new Error(msg || `HTTP ${res.status}`);
   }
 }
+
+// ── Auth helpers ─────────────────────────────────────────────────────────────
+
+export async function checkSetup() {
+  const r = await fetch('/api/auth/setup');
+  const data = await r.json();
+  return data.setup_required === true;
+}
+
+export async function doSetup(username, password) {
+  const r = await fetch('/api/auth/setup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ username, password }),
+  });
+  if (!r.ok) throw new Error((await r.json()).error || 'Setup failed');
+  return r.json();
+}
+
+export async function login(username, password) {
+  const r = await fetch('/api/auth/login', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ username, password }),
+  });
+  if (!r.ok) throw new Error((await r.json()).error || 'Login failed');
+  return r.json();
+}
+
+export async function logout() {
+  await fetch('/api/auth/logout', { method: 'POST' });
+}
+
+export async function fetchMe() {
+  const r = await fetch('/api/auth/me');
+  if (r.status === 401) return null;
+  return r.json();
+}
+
+// ── 401 interceptor ───────────────────────────────────────────────────────────
+const _origFetch = window.fetch;
+window.fetch = async (...args) => {
+  const r = await _origFetch(...args);
+  if (r.status === 401) {
+    const url = typeof args[0] === 'string' ? args[0] : args[0]?.url ?? '';
+    if (!url.includes('/api/auth/')) {
+      window.dispatchEvent(new CustomEvent('auth:expired'));
+    }
+  }
+  return r;
+};