single-user login screen

- server/credentials.py: PBKDF2 password + session secret, 0600 json,
  one-time setup command (server refuses to start without it)
- app.py: signed 30-day cookie (itsdangerous), middleware 401s API /
  redirects pages to /login?next=, 5-fail/15-min lockout, /logout
- static/login.html: dark-themed form, inline error display
- app.js: api() 401 -> redirect to /login preserving current URL
- docs: README quick start + features, SPEC auth section

server/app.py

@@ -8,17 +8,75 @@ import base64
 import json
 import time
 from pathlib import Path
-from urllib.parse import urljoin
+from urllib.parse import quote, urljoin
 
 from fastapi import Body, FastAPI, HTTPException, Query
-from fastapi.responses import Response
+from fastapi.responses import FileResponse, JSONResponse, RedirectResponse, Response
 from fastapi.staticfiles import StaticFiles
+from itsdangerous import BadSignature, TimestampSigner
 
-from . import upstream
+from . import credentials, upstream
 
 ROOT = Path(__file__).parent.parent
 app = FastAPI(title="ani-web")
 
+# ---------- auth: single user, signed cookie ----------
+_SIGNER = TimestampSigner(credentials.load()["secret"])  # exits with instructions if unset
+_SESSION = "aniweb_session"
+_SESSION_AGE = 30 * 86400
+_PUBLIC = {("/login", "GET"), ("/login", "POST")}
+
+# ponytail: in-memory lockout, single process — 5 fails lock for 15 min
+_lockout = {"fails": 0, "until": 0.0}
+
+
+def _auth_ok(request) -> bool:
+    try:
+        return _SIGNER.unsign(request.cookies.get(_SESSION, ""),
+                              max_age=_SESSION_AGE) == b"ok"
+    except BadSignature:
+        return False
+
+
+@app.middleware("http")
+async def require_auth(request, call_next):
+    if (request.url.path, request.method) in _PUBLIC or _auth_ok(request):
+        return await call_next(request)
+    if request.url.path.startswith("/api/"):
+        return JSONResponse({"detail": "not authenticated"}, status_code=401)
+    next_ = request.url.path + (f"?{request.url.query}" if request.url.query else "")
+    return RedirectResponse(f"/login?next={quote(next_, safe='')}", status_code=302)
+
+
+@app.get("/login", include_in_schema=False)
+def login_page():
+    return FileResponse(ROOT / "static" / "login.html")
+
+
+@app.post("/login")
+async def login(payload: dict = Body(...)):
+    if time.time() < _lockout["until"]:
+        return JSONResponse({"detail": "too many attempts, try later"}, status_code=429)
+    if credentials.check(payload.get("password", "")):
+        _lockout.update(fails=0, until=0.0)
+        resp = JSONResponse({"ok": True})
+        resp.set_cookie(_SESSION, _SIGNER.sign(b"ok").decode(),
+                        max_age=_SESSION_AGE, httponly=True, samesite="lax")
+        return resp
+    _lockout["fails"] += 1
+    if _lockout["fails"] >= 5:
+        _lockout.update(fails=0, until=time.time() + 900)
+    time.sleep(0.5)  # slow down brute force
+    return JSONResponse({"detail": "wrong password"}, status_code=401)
+
+
+@app.post("/logout")
+def logout():
+    resp = JSONResponse({"ok": True})
+    resp.delete_cookie(_SESSION)
+    return resp
+
+
 HIST_FILE = Path(__file__).parent / "data" / "history.json"