feat(260606-tv8-01): add guarded GET /api/login route + tests

- Register app.get('/api/login', redirect to '/') in protected-routes block
- Route placed after OIDC guard so unauthenticated nav triggers auth flow
- Add login.test.ts covering bypass and OIDC-passthrough redirect paths

apps/api/src/index.ts

@@ -46,6 +46,16 @@ if (!devBypassActive) {
 }
 
 // Protected API routes (behind oidcAuthMiddleware)
+
+// GET /api/login — login entry point for the PWA.
+// Flow (production): unauthenticated top-level nav hits the OIDC guard above,
+// which 302-redirects to Authelia. After login, Authelia POSTs to /callback,
+// the middleware sets a `continue` cookie pointing back to /api/login, and the
+// browser follows it here — now authenticated. The handler then redirects to /
+// so the SPA boots with a valid session. Under DEV_AUTH_BYPASS the guard is not
+// mounted, so /api/login reaches this handler directly and still redirects to /.
+app.get('/api/login', (c) => c.redirect('/'))
+
 app.route('/api/me', meRouter)
 app.route('/api/events', eventsRouter)
 app.route('/api/sse', sseRouter)