User accounts, login before the title screen, own savegames per user, standalone download

- Service: accounts with Argon2 password hashes and session tokens; the first login creates
  the admin (shared savegames of before move to the admin); the admin creates and deletes
  users; everybody can change the password; savegames are stored and listed per user
- Game: login page before the title (only when the service is reachable), with licence and
  repository link; account page (password, logout; users for the admin); text fields with
  Tab/Enter, masked passwords, browser dialog on touch screens; long status messages wrap
- Download Standalone: DungeonCraft.html with the game embedded (built in the Docker image,
  served to logged-in users via nginx auth_request); works from file:// without server and
  opens downloaded savegames
- Without the service (standalone, local files) there is no login, savegame files as before

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

www/dc_plugin.js

@@ -7,6 +7,8 @@
     var cache = {};          // key -> string, persisted to localStorage when the page is hidden/closed
     var http = {};           // request id -> { done, status, body }
     var httpNext = 1;
+    var token = "";          // login session of the savegame service (sent with every request)
+    var fetched = { state: 0 }; // download of a file from the server: 0 idle, 1 running, 2 done, 3 failed
 
     function bytes(ptr, len) {
         return new Uint8Array(wasm_memory.buffer, ptr, len);
@@ -47,6 +49,7 @@
         var timer = setTimeout(function () { if (ctrl) ctrl.abort(); }, 15000);
         try {
             var opts = { method: method, cache: "no-store", headers: {} };
+            if (token) opts.headers["Authorization"] = "Bearer " + token;
             if (ctrl) opts.signal = ctrl.signal;
             if (body !== null) { opts.body = body; opts.headers["Content-Type"] = "application/json"; }
             fetch(url, opts).then(function (r) {
@@ -69,6 +72,33 @@
 
     function register(importObject) {
         var env = importObject.env;
+        env.dc_set_token = function (tp, tl) {
+            token = tl > 0 ? str(tp, tl) : "";
+        };
+        // fetches a file (with the login) and offers it as a download, without copying it into the game
+        env.dc_fetch_download = function (up, ul, np, nl) {
+            var url = str(up, ul), name = str(np, nl);
+            fetched.state = 1;
+            var opts = { cache: "no-store", headers: {} };
+            if (token) opts.headers["Authorization"] = "Bearer " + token;
+            fetch(url, opts).then(function (r) {
+                if (!r.ok) throw new Error("status " + r.status);
+                return r.blob();
+            }).then(function (blob) {
+                var a = document.createElement("a");
+                a.href = URL.createObjectURL(blob);
+                a.download = name;
+                document.body.appendChild(a);
+                a.click();
+                setTimeout(function () { URL.revokeObjectURL(a.href); a.remove(); }, 2000);
+                fetched.state = 2;
+            }).catch(function () { fetched.state = 3; });
+        };
+        env.dc_fetch_download_state = function () {
+            var s = fetched.state;
+            if (s >= 2) fetched.state = 0;
+            return s;
+        };
         env.dc_http = function (mp, ml, up, ul, bp, bl) {
             var body = bl > 0 ? bytes(bp, bl).slice() : null;
             return httpStart(str(mp, ml), str(up, ul), body);

www/sw.js

@@ -1,7 +1,7 @@
 // DungeonCraft service worker: makes the game installable and playable offline.
 // Network first (updates arrive at once), the cache is the fallback when offline.
 // The savegame service (/api/) is never cached.
-const CACHE = "dungeoncraft-v1";
+const CACHE = "dungeoncraft-v2";
 const CORE = [
   "./",
   "index.html",
@@ -28,7 +28,7 @@ self.addEventListener("activate", (event) => {
 self.addEventListener("fetch", (event) => {
   const req = event.request;
   const url = new URL(req.url);
-  if (req.method !== "GET" || url.origin !== self.location.origin || url.pathname.includes("/api/")) {
+  if (req.method !== "GET" || url.origin !== self.location.origin || url.pathname.includes("/api/") || url.pathname.includes("/standalone/")) {
     return;
   }
   event.respondWith(