preserve Tower Authentik operator login WIP

frontend/src/App.tsx

@@ -26,6 +26,7 @@ function App(): JSX.Element {
       <LandingPage
         serviceError={sessionError}
         guestAccessEnabled={session.guest_access_enabled}
+        authentikEnabled={session.authentik_enabled}
         onAuthenticated={handleAuthenticated}
       />
     )

frontend/src/components/auth/LandingPage.tsx

@@ -28,6 +28,7 @@ interface LandingPageProps {
   onAuthenticated: (session: AuthSession) => void
   serviceError?: string | null
   guestAccessEnabled?: boolean
+  authentikEnabled?: boolean
 }
 
 const capabilityItems = [
@@ -62,6 +63,7 @@ export function LandingPage({
   onAuthenticated,
   serviceError = null,
   guestAccessEnabled = false,
+  authentikEnabled = false,
 }: LandingPageProps): JSX.Element {
   const [username, setUsername] = useState('')
   const [password, setPassword] = useState('')
@@ -247,6 +249,13 @@ export function LandingPage({
                 </div>
 
                 <form onSubmit={submitLogin} aria-busy={pendingAction === 'operator'}>
+                  {authentikEnabled ? (
+                    <a className="landing-authentik-submit" href="/api/v1/auth/authentik/start">
+                      <ShieldCheck aria-hidden="true" />
+                      Aanmelden met Authentik
+                    </a>
+                  ) : null}
+                  {authentikEnabled ? <div className="landing-access-divider"><span>of met lokale operatorgegevens</span></div> : null}
                   <label htmlFor="login-username">Gebruikersnaam</label>
                   <input
                     ref={usernameRef}

frontend/src/services/api/auth.ts

@@ -7,6 +7,7 @@ export interface AuthSession {
   expires_at: string | null
   role: 'operator' | 'guest' | null
   guest_access_enabled: boolean
+  authentik_enabled?: boolean
   guest_project_id: string | null
 }
 

frontend/src/styles/landing.css

@@ -793,6 +793,24 @@ body.landing-body {
   box-shadow: var(--gi-shadow-md);
   transition: background 160ms ease, transform 160ms ease, box-shadow 160ms ease;
 }
+.landing-authentik-submit {
+  display: inline-flex;
+  min-height: 3rem;
+  gap: 0.55rem;
+  align-items: center;
+  justify-content: center;
+  border: 1px solid var(--landing-primary);
+  border-radius: var(--gi-radius-md);
+  padding: 0.72rem 1rem;
+  background: var(--landing-primary);
+  color: #fff;
+  font-size: 0.77rem;
+  font-weight: 600;
+  text-decoration: none;
+  box-shadow: var(--gi-shadow-md);
+}
+.landing-authentik-submit:hover { background: var(--landing-primary-strong); color: #fff; }
+.landing-authentik-submit svg { width: 1rem; height: 1rem; }
 
 .landing-operator-submit:hover:not(:disabled) {
   background: var(--landing-primary-strong);