User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/core/store/AuthStore.ts

@@ -0,0 +1,19 @@
+/**
+ * Signing in and out. The token itself never reaches this code: the server keeps the session and
+ * hands the browser a cookie, so all that travels here is the name behind it.
+ */
+export interface AuthStore {
+  /** The signed-in user, or null while nobody is. */
+  session(): Promise<string | null>;
+  /** The user name on success; a rejected promise when the pair is wrong. */
+  logIn(username: string, password: string): Promise<string>;
+  logOut(): Promise<void>;
+}
+
+/** Thrown for a wrong user name or password, as opposed to a server that is not there. */
+export class WrongCredentialsError extends Error {
+  constructor(message = 'Wrong user name or password') {
+    super(message);
+    this.name = 'WrongCredentialsError';
+  }
+}

src/core/store/HttpAuthStore.ts

@@ -0,0 +1,32 @@
+import { type AuthStore, WrongCredentialsError } from './AuthStore';
+import { apiRequest } from './http';
+
+export class HttpAuthStore implements AuthStore {
+  constructor(private readonly endpoint: string) {}
+
+  async session(): Promise<string | null> {
+    const body = await apiRequest<{ user: string | null }>(this.endpoint, 'GET', 'auth/session');
+    return body.user;
+  }
+
+  async logIn(username: string, password: string): Promise<string> {
+    const body = await apiRequest<{ user: string }>(
+      this.endpoint,
+      'POST',
+      'auth/login',
+      {
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password }),
+      },
+      // A wrong password is the expected answer of a login screen, not a breakdown: it gets its
+      // own type so the screen can say one thing about it and another about a server that is down.
+      (status, data) =>
+        status === 401 ? new WrongCredentialsError((data as { error?: string } | null)?.error) : undefined,
+    );
+    return body.user;
+  }
+
+  async logOut(): Promise<void> {
+    await apiRequest<void>(this.endpoint, 'POST', 'auth/logout');
+  }
+}