#3 — Authentication

[bobinush]

Admins log in with a password. The backend sets a session cookie; all subsequent
API calls send that cookie. A 401 from any API call returns the user to the login screen.

Acceptance criteria:

• Login modal is shown on first load (or when no valid session exists)
• POST /api/auth/login with { password } is called on submit
• Wrong password shows an inline error without navigating away
• Correct password hides the modal and loads the app
• All subsequent fetch calls include credentials: 'include'
• A 401 response from any endpoint re-shows the login modal

[bobinush]

Swagger with auth endpoint here https://bl-map-dev.runasp.net/swagger/

[bobinush]

Since we use a local dev db during early development point 2, 4 and 5 will be postponed :)