User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/lib/SessionStore.php

@@ -0,0 +1,96 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Logins, kept as one file per session in `data/sessions/`, named after the SHA-256 of the token
+ * the browser holds in its cookie – so the file on disk cannot be replayed as a token.
+ *
+ * Deliberately not PHP's own session handler: those expire after `session.gc_maxlifetime`
+ * (24 minutes by default), and a login here has to outlive a deployment and a night, since
+ * `npm run build` replaces the editor under the very tab that is signed in.
+ */
+final class SessionStore
+{
+    /** How long a login lasts without being used; every request that finds it pushes it out again. */
+    public const LIFETIME_SECONDS = 30 * 24 * 60 * 60;
+
+    public const COOKIE = 'game_maker_session';
+
+    public function __construct(private readonly string $dir) {}
+
+    /** Starts a session for `$username` and returns the token for the cookie. */
+    public function create(string $username): string
+    {
+        $this->sweep();
+        $token = bin2hex(random_bytes(32));
+        $this->write($token, ['username' => $username, 'createdAt' => time(), 'seenAt' => time()]);
+        return $token;
+    }
+
+    /** The user behind a token, or null when it is unknown or has expired. */
+    public function user(string $token): ?string
+    {
+        $path = $this->path($token);
+        if ($path === null || !is_file($path)) {
+            return null;
+        }
+        $raw = file_get_contents($path);
+        $data = $raw === false ? null : json_decode($raw, true);
+        if (!is_array($data) || !is_string($data['username'] ?? null) || !is_int($data['seenAt'] ?? null)) {
+            return null;
+        }
+        if (time() - $data['seenAt'] > self::LIFETIME_SECONDS) {
+            @unlink($path);
+            return null;
+        }
+        // Touched at most once an hour: every request rewriting the file would cost a write per
+        // autosave, and the lifetime is measured in weeks.
+        if (time() - $data['seenAt'] > 3600) {
+            $data['seenAt'] = time();
+            $this->write($token, $data);
+        }
+        return $data['username'];
+    }
+
+    public function destroy(string $token): void
+    {
+        $path = $this->path($token);
+        if ($path !== null) {
+            @unlink($path);
+        }
+    }
+
+    /** Throws out what has timed out, so the directory does not grow with every login. */
+    private function sweep(): void
+    {
+        foreach (glob($this->dir . '/*.json') ?: [] as $file) {
+            if (time() - (int) @filemtime($file) > self::LIFETIME_SECONDS) {
+                @unlink($file);
+            }
+        }
+    }
+
+    private function path(string $token): ?string
+    {
+        if (!preg_match('/^[a-f0-9]{64}$/', $token)) {
+            return null;
+        }
+        return $this->dir . '/' . hash('sha256', $token) . '.json';
+    }
+
+    private function write(string $token, array $data): void
+    {
+        if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
+            throw new RuntimeException("Cannot create session directory {$this->dir}");
+        }
+        $path = $this->path($token);
+        if ($path === null) {
+            throw new RuntimeException('Invalid session token');
+        }
+        $json = json_encode($data, JSON_UNESCAPED_SLASHES);
+        if ($json === false || file_put_contents($path, $json, LOCK_EX) === false) {
+            throw new RuntimeException('Cannot write session file');
+        }
+        @chmod($path, 0640);
+    }
+}