feat: add admin login page and authentication API

- Created a new login page for admin access at frontend/admin/login/index.html.
- Implemented form submission with error handling for login credentials.
- Updated frontend/index.html to mute the video player and removed unnecessary Alpine.js data binding.
- Enhanced manifest URL resolution in frontend/src/main.ts to include cache-busting parameters.
- Modified vite.config.ts to include the new admin login page in the build process.
- Updated nginx.conf to handle admin login routing, authentication, and API proxying for admin actions.

SETUP.md

@@ -58,6 +58,12 @@ This guide covers prerequisites, environment setup, running the application loca
    VITE_PUBLIC_APP_URL=https://linearvoid.tv
    VITE_PUBLIC_WS_URL=wss://linearvoid.tv/ws
    VITE_PUBLIC_HLS_URL=https://media.linearvoid.tv/hls/playlist.m3u8
+   VITE_PUBLIC_ADMIN_DEFAULT_MODERATOR=admin
+   VITE_PUBLIC_ADMIN_DEFAULT_ROOM=main
+   VITE_PUBLIC_ADMIN_MODERATION_LOG_LIMIT=50
+   ADMIN_USERNAME=admin
+   ADMIN_PASSWORD=change-me
+   ADMIN_SESSION_TTL_HOURS=12
    # Optional direct-local fallback when bypassing the public proxy:
    # VITE_PUBLIC_APP_URL=http://localhost
    # VITE_PUBLIC_WS_URL=ws://localhost/ws
@@ -188,7 +194,7 @@ This guide covers prerequisites, environment setup, running the application loca
 
 2. **Access the Application**:
    - Preferred local access with the documented proxy setup: <https://linearvoid.tv>
-   - Admin Interface: <https://linearvoid.tv/admin>
+   - Admin Interface: <https://linearvoid.tv/admin> (redirects to `/admin/login/` until authenticated)
    - Chat WebSocket: `wss://linearvoid.tv/ws`
    - Direct-local fallback when bypassing Cloudflare/Nginx Proxy Manager: <http://localhost>, <http://localhost/admin>, and `ws://localhost/ws`
    - Health Checks:
@@ -299,7 +305,7 @@ See `docs/architecture/README.md` for the full arc42 documentation and the ADRs
 - **Chat Not Connecting**: Check Redis connection and WebSocket URL. The health check at `/health` should return 200.
 - **Cache Not Working**: Verify Cloudflare cache rules (`.ts` = long TTL immutable, `.m3u8` = short TTL). Check cache hit ratio in Cloudflare dashboard.
 - **Docker Issues**: Run `docker compose logs` for service-specific errors. Ensure ports are not in use.
-- **Admin Interface**: Ensure the protected route is configured in nginx and authentication is set up (default is open for local development).
+- **Admin Interface**: Ensure `ADMIN_USERNAME`, `ADMIN_PASSWORD`, and `ADMIN_SESSION_TTL_HOURS` are set. `/admin/` and `/api/admin/*` are protected by a session-based login flow.
 - **Production Pull Fails**: Confirm `docker login` to Gitea succeeded on the server and the image tags referenced by `docker-compose.prod.yml` exist.
 
 ## Further Reading