replace Basic Auth with session-based authentication and a login overlay

static/app.js

@@ -101,6 +101,8 @@ document.addEventListener('DOMContentLoaded', () => {
                 addForm.reset();
                 document.getElementById('port').value = "4646";
                 fetchInstances();
+            } else if (res.status === 401) {
+                showLogin();
             } else {
                 alert('Failed to add instance');
             }
@@ -109,12 +111,45 @@ document.addEventListener('DOMContentLoaded', () => {
         }
     });
 
+    loginForm.addEventListener('submit', async (e) => {
+        e.preventDefault();
+        const password = document.getElementById('login-password').value;
+        try {
+            const res = await fetch('/api/login', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ password })
+            });
+            if (res.ok) {
+                hideLogin();
+                loginError.style.display = 'none';
+                document.getElementById('login-password').value = '';
+                fetchConfig();
+                fetchInstances();
+            } else {
+                loginError.style.display = 'block';
+            }
+        } catch (e) {
+            console.error('Login error', e);
+        }
+    });
+
+    logoutBtn.addEventListener('click', async () => {
+        try {
+            await fetch('/api/logout');
+            showLogin();
+        } catch (e) {
+            console.error('Logout error', e);
+        }
+    });
+
     refreshBtn.addEventListener('click', fetchInstances);
 
     window.deleteInstance = async (id) => {
         if (!confirm('Are you sure you want to delete this instance?')) return;
         try {
             const res = await fetch(`/api/instances/${id}`, { method: 'DELETE' });
+            if (res.status === 401) return showLogin();
             if (res.ok) {
                 fetchInstances();
             }