[bitbiter-dev]

Closes #360. Implementation decisions: seeding and rate limits, where the code differs from the design.

Summary

src/Anichron.UI/src/
├── api/
│   ├── client.ts           # POST /api/v1/auth/login; holds the access token in memory only
│   ├── problem.ts          # Problem Details → code, field codes, Retry-After
│   └── login-contract.ts   # hand-written types, deleted by #347
├── shared/use-countdown.ts # counts down to a deadline, one tick per second
├── features/login/
│   ├── LoginPage.tsx
│   ├── use-login-form.ts   # React Hook Form + zod/mini, errors, countdown
│   └── messages.ts         # code → catalog key, generic fallback
└── test/handlers/login.ts  # MSW handlers, deleted by #347

/            beforeLoad: no token → redirect /login   (signed-in placeholder)
/login       sign in → navigate /

API: RateLimit:SensitivePermitLimit, a validated setting with the default unchanged (10). Only docker-compose.e2e.yml raises it, because every e2e request reaches the API from the one Docker bridge address.

E2E users are seeded only through the public API:

• Global setup: rotates the bootstrap admin's first password, and fails if the database isn't fresh.
• Each test: creates its own user with POST /users and changes its temporary password.
• Disabled account: PATCH /users/{id}.
• Locked account: repeated wrong logins.

zod/mini instead of zod, because the full build left the initial JS at 148.5 of the 150 kB budget.

Evidence

• Before: no login screen. / was an unguarded placeholder.
  After:
  • UI tests (seam 2, MSW, axe): 16 pass. They cover success, required fields, each code, unknown code, non-JSON body, network failure, field errors, the locked countdown, the rate-limited countdown, and a missing Retry-After.
  • Scoped mutation: UI 100% (123 killed), backend 100% (75 killed).
  • API unit tests: 777 pass, including the new permit-limit tests (a configured limit of 3 allows 3, then returns 429; 0 and -1 fail at startup).
  • E2E, run locally against the built image: WebKit iPhone and Chromium Pixel pass 12 of 12. They cover success with axe, reload signs out, wrong password, disabled account, and a locked account that counts down and then signs in, with no CSP violations.
  • Firefox: not run. It would not start on the local machine ("Could not find profile folder", including on the unchanged smoke test). Its first run is this PR's E2E job.
• Bundle: initial JS is 130.53 kB of 150 kB (master: 109.32 kB), CSS 117 B of 15 kB.

Merge Danger

Door: two-way

Blast Radius: UI routes

/ now needs a token, so the smoke test checks the login page instead of the placeholder. The API change only adds a setting, and its default is unchanged.

🤖 Generated with Claude Code