replace Basic Auth with session-based authentication and a login overlay

static/app.js

@@ -101,6 +101,8 @@ document.addEventListener('DOMContentLoaded', () => {
                 addForm.reset();
                 document.getElementById('port').value = "4646";
                 fetchInstances();
+            } else if (res.status === 401) {
+                showLogin();
             } else {
                 alert('Failed to add instance');
             }
@@ -109,12 +111,45 @@ document.addEventListener('DOMContentLoaded', () => {
         }
     });
 
+    loginForm.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const password = document.getElementById('login-password').value;
+        try {
+            const res = await fetch('/api/login', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ password })
+            });
+            if (res.ok) {
+                hideLogin();
+                loginError.style.display = 'none';
+                document.getElementById('login-password').value = '';
+                fetchConfig();
+                fetchInstances();
+            } else {
+                loginError.style.display = 'block';
+            }
+        } catch (e) {
+            console.error('Login error', e);
+        }
+    });
+
+    logoutBtn.addEventListener('click', async () => {
+        try {
+            await fetch('/api/logout');
+            showLogin();
+        } catch (e) {
+            console.error('Logout error', e);
+        }
+    });
+
     refreshBtn.addEventListener('click', fetchInstances);
 
     window.deleteInstance = async (id) => {
         if (!confirm('Are you sure you want to delete this instance?')) return;
         try {
             const res = await fetch(`/api/instances/${id}`, { method: 'DELETE' });
+            if (res.status === 401) return showLogin();
             if (res.ok) {
                 fetchInstances();
             }

static/index.html

@@ -17,6 +17,13 @@
                 </svg>
                 <h1>XIVLauncher Remote OTP</h1>
             </div>
+            <button id="logout-btn" class="btn btn-icon btn-logout" title="Logout" style="display: none;">
+                <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                    <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"></path>
+                    <polyline points="16 17 21 12 16 7"></polyline>
+                    <line x1="21" y1="12" x2="9" y2="12"></line>
+                </svg>
+            </button>
         </header>
 
         <main>
@@ -84,6 +91,27 @@
             </div>
         </main>
     </div>
+
+    <div id="login-overlay" class="login-overlay">
+        <div class="login-card">
+            <div class="logo">
+                <svg width="32" height="32" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                    <rect x="3" y="11" width="18" height="11" rx="2" ry="2"></rect>
+                    <path d="M7 11V7a5 5 0 0 1 10 0v4"></path>
+                </svg>
+                <h2>Login Required</h2>
+            </div>
+            <form id="login-form">
+                <div class="form-group">
+                    <label for="login-password">Password</label>
+                    <input type="password" id="login-password" placeholder="Enter your password" required autocomplete="current-password">
+                </div>
+                <button type="submit" class="btn btn-primary">Login</button>
+            </form>
+            <div id="login-error" class="login-error" style="display: none;">Invalid password</div>
+        </div>
+    </div>
+
     <script src="/static/app.js"></script>
 </body>
 </html>

static/style.css

@@ -33,6 +33,44 @@ body {
 
 header {
     margin-bottom: 2rem;
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+}
+
+.login-overlay {
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100%;
+    height: 100%;
+    background-color: var(--bg-color);
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    z-index: 1000;
+}
+
+.login-card {
+    background-color: var(--card-bg);
+    border: 1px solid var(--border-color);
+    border-radius: 12px;
+    padding: 2rem;
+    width: 100%;
+    max-width: 400px;
+    box-shadow: 0 10px 25px -5px rgba(0, 0, 0, 0.3);
+}
+
+.login-card .logo {
+    justify-content: center;
+    margin-bottom: 2rem;
+}
+
+.login-error {
+    color: var(--status-offline);
+    font-size: 0.875rem;
+    margin-top: 1rem;
+    text-align: center;
 }
 
 .logo {