Login & Session Management

The Web UI authenticates users via the /api/login REST API endpoint.

---

Authentication Flow

1. On startup, the UI checks for an existing JWT token stored in browser localStorage under ruseon_token.
2. If no valid token exists, the user is presented with the modal Login dialog.
3. Upon submitting valid credentials (e.g. admin and password), the backend returns a signed 1-hour JWT token with user roles and claims.
4. The token is attached to all outbound fetch and API requests in the Authorization: Bearer <TOKEN> header.
5. If the server responds with 401 Unauthorized (e.g. token expired, or user role revoked in BadgerDB), the UI automatically clears localStorage and prompts the login modal.