User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/editor/console/ConsolePanel.ts

@@ -1,4 +1,13 @@
-import { Button, HStack, Label, Panel, ScrollContainer, type TextStyleToken, VStack } from '../../ui';
+import {
+  Button,
+  HStack,
+  Label,
+  Panel,
+  ScrollContainer,
+  type TextStyleToken,
+  VStack,
+  type Widget,
+} from '../../ui';
 import { consoleLog, type ConsoleLog, formatTime, type LogLevel } from './log';
 
 const ROW_HEIGHT = 18;
@@ -25,13 +34,20 @@ export class ConsolePanel extends Panel {
   private readonly rows = new VStack();
   private readonly views: Row[] = [];
   private stale = true;
+  private readonly releaseLog: () => void;
 
   constructor(private readonly log: ConsoleLog = consoleLog) {
     super({ title: 'Console', padding: 0, gap: 0 });
     this.header.add(new Button('Clear', { variant: 'ghost', onClick: () => this.log.clear() }));
     this.scroll.setContent(this.rows);
     this.content.add(this.scroll, 1);
-    this.log.onChange(() => (this.stale = true));
+    this.releaseLog = this.log.onChange(() => (this.stale = true));
+  }
+
+  /** The log outlives the panel – signing out destroys the panel while the page stays up (#177). */
+  override destroy(options?: Parameters<Widget['destroy']>[0]): void {
+    this.releaseLog();
+    super.destroy(options);
   }
 
   refresh(): void {

src/editor/console/log.ts

@@ -98,8 +98,10 @@ export class ConsoleLog {
     for (const listener of this.listeners) listener();
   }
 
-  onChange(listener: () => void): void {
+  /** Returns the call that takes the listener away again – a panel destroyed on sign-out (#177). */
+  onChange(listener: () => void): () => void {
     this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
   }
 }