User management: signing in is required before anything is loaded, the sign-in screen is drawn in the same canvas (user name, password as bullets, Enter moves on and submits) and the editor is built only after it; the API gained auth/session, auth/login and auth/logout while every other route answers 401 without a session, projects carry an owner and a foreign one comes back as 404, accounts live in data/users.json with a password hash and sessions as files in data/sessions with a sliding 30 days, so a build under the open tab does not sign anybody out; Logout sits at the far right of the toolbar and, as asked in the issue, does not reload the page: Editor.dispose() takes the editor down while the canvas stays, which is why the autosave, the focus handlers, the window listeners of the tilemap panel, the shortcuts and the plugins all got a way back; the tools sign in as e2e (tools/lib/auth.mjs, password from GAME_MAKER_E2E_PASSWORD or the git-ignored data/e2e-password.txt) and the browser gets the same session by cookie, new e2e module 45 covers the screen, the wrong pair, the bullets, logout without a reload and signing in again, new unit tests for HttpAuthStore and for what a session leaves behind (#177)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/make-user.php

@@ -0,0 +1,36 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Creates an account or sets the password of one that exists. The API has no route for it:
+ * signing up is a follow-up issue, so until then accounts are made here, on the server.
+ *
+ * Usage: php tools/make-user.php <username> <password>
+ *        php tools/make-user.php --list
+ */
+
+require __DIR__ . '/../api/lib/UserStore.php';
+
+$file = dirname(__DIR__) . '/data/users.json';
+$store = new UserStore($file);
+
+$args = array_slice($argv, 1);
+if (($args[0] ?? '') === '--list') {
+    foreach ($store->names() as $name) {
+        echo $name, "\n";
+    }
+    exit(0);
+}
+if (count($args) !== 2 || $args[0] === '' || $args[1] === '') {
+    fwrite(STDERR, "Usage: php tools/make-user.php <username> <password>\n");
+    exit(2);
+}
+
+[$username, $password] = $args;
+if (!UserStore::isValidName($username)) {
+    fwrite(STDERR, "Invalid user name: {$username}\n");
+    exit(2);
+}
+$existed = $store->exists($username);
+$store->put($username, $password);
+echo ($existed ? 'password set for ' : 'created '), $username, "\n";