Login feature flag added.

src/lib/authClient.ts

@@ -134,26 +134,41 @@ export function register(
   return requestUser(fetchFn, "/api/auth/register", { username, password });
 }
 
+/** Result of the startup /me probe (fetchAuthStatus). */
+export interface AuthStatus {
+  /**
+   * Whether this deployment offers login at all. False when the server 404s
+   * /api/auth/me (runtime feature flag AUTH_ENABLED=false, D-015) — and also
+   * while the server is unreachable, since signing in is impossible then
+   * anyway. The auth UI renders nothing until this is true.
+   */
+  enabled: boolean;
+  /** The signed-in user, or null when anonymous. */
+  user: AuthUser | null;
+}
+
 /**
- * GET /api/auth/me → the current user, or null when anonymous. NEVER rejects:
+ * GET /api/auth/me → auth availability + the current user. NEVER rejects:
  * the app is offline-first and /api/* is network-only in the service worker,
- * so 401s, network failures, and malformed bodies all resolve to anonymous
- * without surfacing an error (Architecture.md §5 anonymous-first invariant).
+ * so 401s and malformed bodies resolve to anonymous, and 404 (feature flag
+ * off, D-015) and network failure resolve to `enabled: false` — none of them
+ * surface an error (Architecture.md §5 anonymous-first invariant).
  */
-export async function fetchCurrentUser(
+export async function fetchAuthStatus(
   fetchFn: FetchLike = defaultFetch,
-): Promise<AuthUser | null> {
+): Promise<AuthStatus> {
   try {
     const response = await fetchFn("/api/auth/me", {
       method: "GET",
       credentials: "same-origin",
     });
-    if (!response.ok) return null;
-    const payload: unknown = await response.json();
+    if (response.status === 404) return { enabled: false, user: null };
+    if (!response.ok) return { enabled: true, user: null };
+    const payload: unknown = await response.json().catch(() => null);
     const user = (payload as { user?: unknown } | null)?.user;
-    return isAuthUser(user) ? user : null;
+    return { enabled: true, user: isAuthUser(user) ? user : null };
   } catch {
-    return null;
+    return { enabled: false, user: null };
   }
 }