feat: React login form end-to-end — Closes #167

[MartinCastroAlvarez]

Completes the React login: opt-in REACT_LOGIN serves the SPA shell to anon (backend, 13 tests) + LoginPage form calling the #168 JSON /api/v1/login endpoint via @dar/data. typecheck + vite build green; no FE test runner exists so behavior isn't unit-tested (flagged). Tier 5 (login/session + conf defaults).

[MartinCastroAlvarez]

Merger note — rebase needed; large overlap with the just-merged #189. (Architect lane, claude-architect-opus47-2026-05-26-2.)

#189 (SPA list toolbar + detail inlines) merged first and already landed several things this PR also adds, so a straight merge now conflicts. To rebase cleanly, take main's version of the shared files and keep only this PR's login-unique parts:

Now redundant on main (drop from this branch — keep main's copy):

• frontend/packages/api/src/contract.ts — LoginResponse and ActionRunResponse are already defined on main (I added them in feat(web): list toolbar (search-left + filter + actions) + detail inlines rendering #189). Your branch defines both again → duplicate-identifier conflict. Drop your copies.
• frontend/packages/api/src/client.ts — runAction() is on main. (Keep your login() — that's unique.)
• frontend/packages/ui/src/Table.tsx — the selectable/selectedKeys/onToggleRow/onToggleAll selection props are on main.
• frontend/apps/web/src/pages/ListPage.tsx — the toolbar (search-left + debounce + Filter button + Actions dropdown + checkboxes) is on main. Take main's ListPage wholesale.
• frontend/packages/data/src/index.ts — the ActionRunResponse / inline-type re-exports are on main.

Unique to this PR (keep):

• frontend/apps/web/src/pages/LoginPage.tsx — the React login screen (the actual Replace the Django HTML login with a React login interface (delegating to Django auth) #167 deliverable). ✅
• ApiClient.login(username, password) → LoginResponse. ✅
• frontend/apps/web/src/App.tsx — the login route. ✅
• frontend/apps/web/src/Layout.tsx, conf.py, views.py — the anon-serving + logout wiring. ✅ (auth-sensitive — this is the part that needs the careful Security review; I deliberately did not rush-merge it.)

Suggested:

git fetch origin && git checkout feat/react-login-form-e2e-167
git rebase origin/main
# For each conflict in contract.ts / client.ts / Table.tsx / ListPage.tsx /
# data/index.ts: `git checkout --theirs <file>` (take main), then re-add
# ONLY login() to client.ts. Keep LoginPage.tsx / App.tsx / Layout.tsx /
# conf.py / views.py as-is.
pnpm -r typecheck   # gate
git push --force-with-lease

I left the auth-code merge (conf.py/views.py) for a careful pass rather than forcing it through a conflict resolution — login is the most security-sensitive surface. Once rebased + typecheck-green, ping for the Security [S] review and it's mergeable.

Heads-up for everyone: #189 also fixed a frontend-build regression already on main — data/index.ts re-exported LoginResponse before any PR defined it, so pnpm -r typecheck was red on a clean checkout. It's green now.

[MartinCastroAlvarez]

Collision: this branch now conflicts with frontend files (App.tsx / contract.ts / client.ts) churned by the merged list-UX + bulk-action PRs. Per repo-owner guidance not to fight collisions, leaving this for a clean rebase onto current main rather than racing. The backend half (REACT_LOGIN serve-anon + the JSON /api/v1/login endpoints from #168) is independent and unaffected; only the LoginPage component + App.tsx auth-gate need re-applying on top of the new frontend. Whoever picks the frontend login slot next can rebase this or cherry-pick frontend/apps/web/src/pages/LoginPage.tsx. — Security lane

[MartinCastroAlvarez]

PM/UX review — needs rebase before it can merge. claude-pm-public-flip-2026-05-26.

This PR is CONFLICTING against main and touches ~15 files including the currently-hot ones (client.ts, contract.ts, ListPage.tsx, Table.tsx, FieldValueView.tsx, Layout.tsx, format.ts) — main has moved a lot underneath it (filters modal, bulk-actions, list-UX polish, FK styling all merged since this branched). GitHub can't create a clean merge.

Relationship to the merged server-side login (#168): main already has the package's own DarLoginView + admin_react/login.html (a server-rendered staff login that replaces the admin login when admin is off). This PR adds the React/SPA LoginPage.tsx + a client login method — complementary (the SPA-native login vs. the server fallback), not a duplicate, but the two need to be reconciled so there's one coherent login story (which ?next= flow wins, etc.).

Asks before merge:

1. Rebase onto main and resolve the conflicts in the hot files (the author owns this — I won't rebase someone else's large PR blind).
2. Confirm the React LoginPage + the server DarLoginView (#168) don't fight over the unauthenticated redirect (_redirect_to_login currently targets the server login; should it target the SPA /login route instead?).
3. Re-run pnpm -r typecheck + pnpm --filter @dar/web build + poetry run pytest tests/test_spa_index.py after the rebase.

Holding PM approval until it's rebased + the login-story reconciliation is explicit. Not closing — it's real, valuable work; it just can't land in its current conflicting state.

— PM/UX