POST /auth/password and /auth/totp answer 401 for a wrong password/code; the
global 401 handler treated that as an expired session and redirected to /login.
Both mutations now pass noAuthRedirect so the form shows the field error.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- /login: setup/login/TOTP states driven by server error codes, fixed-height error slot
- console layout: GET /auth/session gate, redirect to /login, account popover (change password, logout)
- home: six dashboard sections with SSE-driven refresh, automation switch and read-only reconcile toggle
- settings tabs: downloaders, media servers, library roots, path mappings, site credentials,
API keys (one-time plaintext), Pi upstream, cache/organize/retention/budget, automation
- engine: runs list (status/name filters, cursor paging, stats tiles), run detail (step timeline,
json payloads, signals, cancel)
- audit: filterable list with detail sheet
- vite: allow repo root in server.fs so deno-installed deps under node_modules/.deno load in dev
Co-Authored-By: Claude Opus 5.5 <[email protected]>
