User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/lib/projects.mjs

@@ -12,6 +12,7 @@
  */
 import { readFile } from 'node:fs/promises';
 import { basename, extname } from 'node:path';
+import { authHeaders } from './auth.mjs';
 
 export const PROJECTS = {
   playground: '649188c15414',
@@ -61,7 +62,7 @@ export async function uploadTexture(baseUrl, filePath) {
   }
   const res = await fetch(`${baseUrl}api/index.php?r=textures`, {
     method: 'POST',
-    headers: { 'Content-Type': type },
+    headers: { 'Content-Type': type, ...(await authHeaders(baseUrl)) },
     body: bytes,
     signal: AbortSignal.timeout(20_000),
   });
@@ -95,7 +96,7 @@ export async function uploadFont(baseUrl, filePath) {
   const name = encodeURIComponent(basename(filePath));
   const res = await fetch(`${baseUrl}api/index.php?r=fonts&name=${name}`, {
     method: 'POST',
-    headers: { 'Content-Type': type },
+    headers: { 'Content-Type': type, ...(await authHeaders(baseUrl)) },
     body: bytes,
     signal: AbortSignal.timeout(20_000),
   });
@@ -116,7 +117,7 @@ export async function uploadFont(baseUrl, filePath) {
 export async function uploadSound(baseUrl, bytes, fileName, type = 'audio/wav') {
   const res = await fetch(`${baseUrl}api/index.php?r=sounds&name=${encodeURIComponent(fileName)}`, {
     method: 'POST',
-    headers: { 'Content-Type': type },
+    headers: { 'Content-Type': type, ...(await authHeaders(baseUrl)) },
     body: bytes,
     signal: AbortSignal.timeout(20_000),
   });
@@ -134,7 +135,8 @@ export async function writeProject(projectId, baseUrl, project) {
   // A request without a timeout keeps its socket open, so a stalled server hangs the seed
   // instead of failing it – and the run that follows never starts.
   const timeout = () => AbortSignal.timeout(20_000);
-  const current = await fetch(url, { signal: timeout() });
+  const headers = await authHeaders(baseUrl);
+  const current = await fetch(url, { headers, signal: timeout() });
   if (!current.ok) {
     console.error(`GET failed: ${current.status} – create the project first (POST ?r=projects)`);
     process.exit(1);
@@ -146,7 +148,7 @@ export async function writeProject(projectId, baseUrl, project) {
   };
   const res = await fetch(url, {
     method: 'PUT',
-    headers: { 'Content-Type': 'application/json' },
+    headers: { 'Content-Type': 'application/json', ...headers },
     body: JSON.stringify(body),
     signal: timeout(),
   });