Add Authorization Bearer header to all fetch calls (apps, stream
start). Handle 401 responses by clearing token and redirecting to
login. Pass stream_token from the stream start response through to
the WebTransport URL as a query parameter for proxy authentication.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add authentication flow to the frontend:
- authStore with token management (localStorage persistence)
- Login page with username/password form at /login
- Layout-level auth guard that redirects to /login when no valid
session exists, validates token on load via GET /api/auth/me
- Top navigation bar showing username and admin link when applicable
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>