User accounts, login before the title screen, own savegames per user, standalone download

- Service: accounts with Argon2 password hashes and session tokens; the first login creates
  the admin (shared savegames of before move to the admin); the admin creates and deletes
  users; everybody can change the password; savegames are stored and listed per user
- Game: login page before the title (only when the service is reachable), with licence and
  repository link; account page (password, logout; users for the admin); text fields with
  Tab/Enter, masked passwords, browser dialog on touch screens; long status messages wrap
- Download Standalone: DungeonCraft.html with the game embedded (built in the Docker image,
  served to logged-in users via nginx auth_request); works from file:// without server and
  opens downloaded savegames
- Without the service (standalone, local files) there is no login, savegame files as before

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/make_standalone.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Builds DungeonCraft as one self-contained HTML file (no server needed, works from file://).
+
+The JavaScript bundle, the plugin and the WASM module (base64) are embedded; fetching
+"dungeoncraft.wasm" is answered from the embedded bytes. Service worker and manifest are left
+out. Without the savegame service the game uses savegame files (download / file picker), so
+savegames downloaded from the server open in the standalone version as well.
+
+usage: make_standalone.py <www dir with dungeoncraft.wasm and mq_js_bundle.js> <output.html>
+"""
+import base64
+import pathlib
+import sys
+
+www = pathlib.Path(sys.argv[1])
+out = pathlib.Path(sys.argv[2])
+
+wasm = base64.b64encode((www / "dungeoncraft.wasm").read_bytes()).decode()
+bundle = (www / "mq_js_bundle.js").read_text()
+plugin = (www / "dc_plugin.js").read_text()
+icon = base64.b64encode((www / "icons" / "icon-192.png").read_bytes()).decode()
+
+# keep a "</script>" inside the code from ending the script element
+def safe(js: str) -> str:
+    return js.replace("</script", "<\\/script")
+
+html = f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>DungeonCraft</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="theme-color" content="#080608">
+  <link rel="icon" type="image/png" href="data:image/png;base64,{icon}">
+  <style>
+    html, body {{ margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: #080608; }}
+    canvas {{ display: block; width: 100%; height: 100%; outline: none; image-rendering: pixelated; }}
+  </style>
+</head>
+<body>
+  <canvas id="glcanvas" tabindex="1" oncontextmenu="return false"></canvas>
+  <!-- DungeonCraft standalone - MIT License - (c) 2026 Richard Zink - https://git.familie-zink.org/zink/dungeoncraft -->
+  <script>var register_plugin; /* expected by the quad_net plugin in the bundle */</script>
+  <script>
+    // the game module is embedded: fetching it is answered from these bytes
+    var DC_WASM = "{wasm}";
+    (function () {{
+      var realFetch = window.fetch ? window.fetch.bind(window) : null;
+      window.fetch = function (url, opts) {{
+        if (typeof url === "string" && url.indexOf("dungeoncraft.wasm") >= 0) {{
+          var bin = atob(DC_WASM);
+          var bytes = new Uint8Array(bin.length);
+          for (var i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+          return Promise.resolve(new Response(bytes, {{ headers: {{ "Content-Type": "application/wasm" }} }}));
+        }}
+        return realFetch ? realFetch(url, opts) : Promise.reject(new Error("offline"));
+      }};
+    }})();
+  </script>
+  <script>{safe(bundle)}</script>
+  <script>{safe(plugin)}</script>
+  <script>
+    document.getElementById("glcanvas").focus();
+    load("dungeoncraft.wasm");
+  </script>
+</body>
+</html>
+"""
+out.write_text(html)
+print(f"{out}: {len(html) // 1024} KB")