User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/lib/Auth.php

@@ -0,0 +1,73 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Who is asking. The browser sends the session cookie; the check tools log in the same way and
+ * send the same cookie, so there is exactly one way into the API.
+ */
+final class Auth
+{
+    public function __construct(
+        private readonly UserStore $users,
+        private readonly SessionStore $sessions,
+    ) {}
+
+    /** The signed-in user, or null when nobody is. */
+    public function user(): ?string
+    {
+        $token = (string) ($_COOKIE[SessionStore::COOKIE] ?? '');
+        return $token === '' ? null : $this->sessions->user($token);
+    }
+
+    /** The signed-in user, or a 401 answer – every route but `auth/*` goes through here. */
+    public function require(): string
+    {
+        $user = $this->user();
+        if ($user === null) {
+            Response::error('Sign in first', 401);
+        }
+        return $user;
+    }
+
+    /** Checks the pair, starts a session and sets the cookie. Null when the pair is wrong. */
+    public function logIn(string $username, string $password): ?string
+    {
+        $name = $this->users->verify($username, $password);
+        if ($name === null) {
+            return null;
+        }
+        $this->setCookie($this->sessions->create($name), time() + SessionStore::LIFETIME_SECONDS);
+        return $name;
+    }
+
+    public function logOut(): void
+    {
+        $token = (string) ($_COOKIE[SessionStore::COOKIE] ?? '');
+        if ($token !== '') {
+            $this->sessions->destroy($token);
+        }
+        $this->setCookie('', time() - 3600);
+    }
+
+    private function setCookie(string $value, int $expires): void
+    {
+        setcookie(SessionStore::COOKIE, $value, [
+            'expires' => $expires,
+            'path' => self::basePath(),
+            'httponly' => true,
+            'samesite' => 'Lax',
+            'secure' => ($_SERVER['HTTPS'] ?? '') !== '',
+        ]);
+    }
+
+    /**
+     * The path the editor is served under (`/game-maker/`), read off the script rather than
+     * written down: the same checkout answers under a different prefix in CI.
+     */
+    private static function basePath(): string
+    {
+        $script = (string) ($_SERVER['SCRIPT_NAME'] ?? '/game-maker/api/index.php');
+        $base = dirname(dirname($script));
+        return $base === '/' || $base === '\\' || $base === '.' ? '/' : $base . '/';
+    }
+}