feat: add operator landing and login

scripts/verify_browser_runtime.sh

@@ -3,7 +3,8 @@ set -euo pipefail
 
 FRONTEND_URL="${1:-http://localhost:1202}"
 BACKEND_HEALTH_URL="${2:-}"
-API_URL="${FRONTEND_URL%/}/api/v1/projects"
+API_URL="${FRONTEND_URL%/}/api/v1/auth/session"
+PROJECTS_API_URL="${FRONTEND_URL%/}/api/v1/projects"
 ICON_URL="${FRONTEND_URL%/}/geointel-icon.png"
 
 if ! command -v curl >/dev/null 2>&1; then
@@ -14,19 +15,23 @@ fi
 echo "== GeoIntel browser runtime verification =="
 echo "Frontend: ${FRONTEND_URL}"
 echo "API through frontend proxy: ${API_URL}"
+echo "Protected API through frontend proxy: ${PROJECTS_API_URL}"
 echo "Icon: ${ICON_URL}"
 
 frontend_status=""
 api_response=""
+projects_status=""
 icon_status=""
 
 for attempt in $(seq 1 60); do
   frontend_status="$(curl -fsS -o /dev/null -w "%{http_code}" "${FRONTEND_URL}" 2>/dev/null || true)"
   icon_status="$(curl -fsS -o /dev/null -w "%{http_code}" "${ICON_URL}" 2>/dev/null || true)"
   api_response="$(curl -fsS "${API_URL}" 2>/dev/null || true)"
+  projects_status="$(curl -sS -o /dev/null -w "%{http_code}" "${PROJECTS_API_URL}" 2>/dev/null || true)"
 
   if [ "${frontend_status}" = "200" ] \
     && [ "${icon_status}" = "200" ] \
+    && { [ "${projects_status}" = "200" ] || [ "${projects_status}" = "401" ]; } \
     && printf '%s' "${api_response}" | grep -q '"data"'; then
     break
   fi
@@ -40,6 +45,11 @@ if [ "${frontend_status}" != "200" ]; then
   exit 1
 fi
 
+if [ "${projects_status}" != "200" ] && [ "${projects_status}" != "401" ]; then
+  echo "Protected API returned HTTP ${projects_status:-none}, expected 200 (auth disabled) or 401 (auth enabled)" >&2
+  exit 1
+fi
+
 if [ "${icon_status}" != "200" ]; then
   echo "Icon returned HTTP ${icon_status:-none}, expected 200" >&2
   exit 1