feat: harden authenticated deployment

public/js/landing.js

@@ -0,0 +1,24 @@
+const form = document.querySelector("#auth-form");
+const message = document.querySelector("#message");
+
+async function submit(url) {
+	const response = await fetch(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(Object.fromEntries(new FormData(form))),
+	});
+	const body = await response.json();
+	if (!response.ok) {
+		message.textContent = body.error || body.code;
+		return;
+	}
+	location.assign("/app");
+}
+
+form.addEventListener("submit", (event) => {
+	event.preventDefault();
+	submit("/api/auth/login");
+});
+document.querySelector("#signup").addEventListener("click", () =>
+	submit("/api/auth/signup"),
+);