single-user login screen

- server/credentials.py: PBKDF2 password + session secret, 0600 json,
  one-time setup command (server refuses to start without it)
- app.py: signed 30-day cookie (itsdangerous), middleware 401s API /
  redirects pages to /login?next=, 5-fail/15-min lockout, /logout
- static/login.html: dark-themed form, inline error display
- app.js: api() 401 -> redirect to /login preserving current URL
- docs: README quick start + features, SPEC auth section

README.md

@@ -8,14 +8,19 @@ workflow: search, browse, and stream anime in the browser via anidb.app.
 ```sh
 uv venv .venv
 uv pip install --python .venv/bin/python -r requirements.txt
+.venv/bin/python -m server.credentials   # set the login password (one-time)
 ./run.sh
 ```
 
 Open <http://localhost:8321>. `run.sh` restarts cleanly if the server
-is already running; logs go to `server.log`.
+is already running; logs go to `server.log`. The server refuses to
+start without a password.
 
 ## Features
 
+- Login: single shared password, 30-day session cookie,
+  5 wrong attempts → 15-min lockout. PBKDF2-SHA256 hash + session
+  secret in `server/data/credentials.json` (0600).
 - Search with poster grid, detail view with synopsis + season tabs
 - HLS playback (vendored hls.js), browser ABR across 1080/720/360p
 - Dub/sub toggle