frontend: prefix-agnostic fetch paths (reverse-proxy subpath safe)

login.html/app.js now resolve fetch targets relative to the page's
directory (BASE), so the app works served at / or under a path prefix
(https://host/ani/) as long as the proxy strips the prefix.

static/login.html

@@ -27,15 +27,21 @@ button { width:100%; margin-top:.4rem; padding:.55rem; border:0; border-radius:8
   <p class="err" id="err"></p>
 </form>
 <script>
+// base = this page's directory, so the app works at / or behind a
+// prefixing reverse proxy (e.g. https://host/ani/)
+const BASE = (() => {
+  const p = location.pathname;
+  return p.endsWith("/") ? p : p.slice(0, p.lastIndexOf("/") + 1);
+})();
 const $ = id => document.getElementById(id);
 const next = new URLSearchParams(location.search).get("next");
 $("go").onclick = async () => {
   $("err").textContent = "";
-  const r = await fetch("/login", {method: "POST",
+  const r = await fetch(BASE + "login", {method: "POST",
     headers: {"Content-Type": "application/json"},
     body: JSON.stringify({username: $("user").value, password: $("pw").value})});
   if (r.ok) {
-    location.href = (next && next.startsWith("/") && !next.startsWith("//")) ? next : "/";
+    location.href = next ? BASE + next.replace(/^\/+/, "") : BASE;
   } else {
     $("err").textContent = (await r.json().catch(() => ({}))).detail || "login failed";
   }