Frontend for pansy auth, rendering whatever /auth/providers reports.

- lib/auth.ts: zod-validated User/Providers, a shared meQueryOptions
  (a 401 resolves to null, not an error) reused by useMe() and the router
  guard, useProviders(), and useLogin/useRegister/useLogout mutations that
  prime/clear the me cache (logout also drops non-auth cached data).
- lib/queryClient.ts: one QueryClient shared by the React tree and the
  router context so guard and components hit the same cache.
- router.tsx: createRootRouteWithContext with the queryClient; requireAuth
  (redirects to /login?redirect=<dest>) on gardens/plants/editor, and
  requireGuest on login/register (bounces authed users away). Login search
  params (redirect, error) validated as optional; redirect targets are
  restricted to same-origin paths.
- pages/LoginPage: OIDC button (label from providers) linking to
  /auth/oidc/login, "or" divider, local email/password form, and friendly
  messages for the OIDC callback ?error= codes. RegisterPage: email +
  display name + password (min 8), registration-closed and SSO-only
  handling; auto-login lands on /gardens.
- AppShell: auth-aware nav — shows the user's display name + Sign out when
  logged in, Sign in otherwise; nav links only when authed.
- ui/: TextField (16px text to avoid iOS zoom, autocomplete + a11y),
  Button (+ shared buttonClasses for the OIDC anchor), Alert; AuthCard.

Verified in a real browser against the embedded binary: register →
auto-login → /gardens; refresh stays in; Sign out → /login; a logged-out
/gardens/1 redirects to /login and returns after login; OIDC button renders
with the Authentik label when configured. tsc --noEmit clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

@@ -14,6 +15,16 @@ const navLinkInactive = 'text-muted hover:bg-border/60 hover:text-fg'
 
 /** Top-level chrome: a sticky nav bar plus the routed page in an <Outlet>. */
 export function AppShell() {
+  const me = useMe()

@@ -17,0 +20,4 @@
+  const navigate = useNavigate()
+  const user = me.data
+
+  async function onLogout() {

@@ -0,0 +11,4 @@
+export const TextField = forwardRef<HTMLInputElement, TextFieldProps>(function TextField(
+  { label, hint, id, name, className, ...props },
+  ref,
+) {

@@ -0,0 +31,4 @@
+  queryFn: async (): Promise<User | null> => {
+    try {
+      return userSchema.parse(await api.get('/auth/me'))
+    } catch (err) {

@@ -0,0 +36,4 @@
+      throw err
+    }
+  },
+  staleTime: 60_000,

@@ -0,0 +86,4 @@
+export function useLogout() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: () => api.post('/auth/logout'),

@@ -0,0 +96,4 @@
+  })
+}
+
+/** The server error code from an ApiError body ({error:{code,message}}), if any. */

@@ -0,0 +106,4 @@
+}
+
+/** A user-facing message for a caught request error. */
+export function errorMessage(err: unknown, fallback = 'Something went wrong.'): string {

@@ -2,0 +8,4 @@
+
+// Server-initiated redirect (not a fetch): the browser navigates to the Go
+// handler, which 302s to the IdP.
+const OIDC_LOGIN_URL = '/api/v1/auth/oidc/login'

@@ -2,0 +21,4 @@
+}
+
+// Only follow same-origin absolute paths, never a caller-controlled external URL.
+function safeRedirect(dest: string | undefined): string {

@@ -5,0 +34,4 @@
+  const [password, setPassword] = useState('')
+
+  const dest = safeRedirect(search.redirect)
+  const callbackError = search.error ? (callbackErrors[search.error] ?? callbackErrors.oidc) : null

@@ -5,0 +39,4 @@
+  async function onSubmit(e: FormEvent) {
+    e.preventDefault()
+    try {
+      await login.mutateAsync({ email, password })

@@ -5,0 +57,4 @@
+        {providers.isPending && <p className="text-sm text-muted">Loading…</p>}
+        {providers.isError && <Alert>Could not load sign-in options. Please refresh.</Alert>}
+
+        {oidc && (

@@ -5,0 +66,4 @@
+        {oidc && local && <Divider>or</Divider>}
+
+        {local && (
+          <form onSubmit={onSubmit} className="flex flex-col gap-3" noValidate>

@@ -5,0 +111,4 @@
+  )
+}
+
+function Divider({ children }: { children: ReactNode }) {

@@ -5,0 +27,4 @@
+  }
+
+  // Local registration is only meaningful when local auth is enabled.
+  if (providers.isSuccess && !providers.data.local) {

@@ -5,0 +52,4 @@
+          </Link>
+        </div>
+      ) : (
+        <form onSubmit={onSubmit} className="flex flex-col gap-3" noValidate>

@@ -15,0 +22,4 @@
+
+// requireAuth: resolve the current user (shared cache with useMe); send anyone
+// unauthenticated to /login, remembering where they were headed.
+async function requireAuth(context: RouterContext, href: string) {

@@ -15,0 +37,4 @@
+  }
+}
+
+function safeInternalPath(dest: string | undefined): string {

@@ -29,0 +79,4 @@
+const gardensRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  path: 'gardens',
+  beforeLoad: ({ context, location }) => requireAuth(context, location.href),