fix: redirect to login on 401, fix static file serving

- Add auth guard in API client: 401 responses redirect to /login
- Fix go:embed with all: prefix to include _app/ directory
- Move jsonContentType middleware to /api routes only
- Use http.ServeContent for correct MIME type detection

web/src/lib/api.ts

@@ -46,6 +46,13 @@ async function request<T>(path: string, init?: RequestInit): Promise<T> {
 		headers
 	});
 
+	// Redirect to login on 401 (expired/missing token).
+	if (res.status === 401 && typeof window !== 'undefined' && !path.includes('/auth/')) {
+		localStorage.removeItem('auth_token');
+		window.location.href = '/login';
+		throw new ApiError('Authentication required', 401);
+	}
+
 	let envelope: ApiEnvelope<T>;
 	try {
 		envelope = await res.json();