Secure login error rendering and admin authorization

[yortch]

User story

As a user, I want login errors and access decisions to be handled securely so that untrusted input cannot execute code and only authorized users can access administrative features.

Context

The frontend currently renders the login error query parameter with dangerouslySetInnerHTML in frontend/src/components/Login.tsx. Authentication and admin status are also currently determined client-side in frontend/src/context/AuthContext.tsx, where any non-empty credentials succeed and an @github.com address receives admin access.

Acceptance criteria

• Login errors are rendered as plain text; dangerouslySetInnerHTML is removed from the login flow.
• A malicious error query parameter containing HTML or script markup is displayed inertly.
• Credentials are validated by the API rather than accepted solely because both fields are non-empty.
• Admin status comes from server-authenticated state, not an arbitrary @github.com email address.
• Unauthenticated users cannot access /admin/products.
• API mutations independently enforce authorization.
• Login failures, network errors, logout, and session expiry provide clear feedback without exposing sensitive details.
• Focused security/authentication tests are added and pass.
• Frontend lint and build, plus relevant API tests and build, pass.

Implementation notes

• Update frontend/src/components/Login.tsx to render error text safely and add a regression test for malicious query parameters.
• Trace the existing API authentication contract under api/src before changing the frontend auth state.
• Update frontend/src/context/AuthContext.tsx to use server-backed authentication, represent loading/error state, and clear state on logout or session failure.
• Keep the route guard in frontend/src/components/admin/AdminProducts.tsx, but make it depend on server-backed auth state.
• Verify API routes enforce authorization independently of frontend navigation.

Scope

Included: login error rendering and authentication/authorization correctness.

Excluded: unrelated visual redesign, broad dependency upgrades, and general XSS auditing outside the login flow.