feat: add admin login page and authentication API

- Created a new login page for admin access at frontend/admin/login/index.html.
- Implemented form submission with error handling for login credentials.
- Updated frontend/index.html to mute the video player and removed unnecessary Alpine.js data binding.
- Enhanced manifest URL resolution in frontend/src/main.ts to include cache-busting parameters.
- Modified vite.config.ts to include the new admin login page in the build process.
- Updated nginx.conf to handle admin login routing, authentication, and API proxying for admin actions.

infrastructure/nginx/nginx.conf

@@ -31,7 +31,31 @@ http {
             return 301 /admin/;
         }
 
+        location = /admin/login {
+            return 301 /admin/login/;
+        }
+
+        location = /_admin_auth {
+            internal;
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream/api/admin/session;
+            proxy_http_version 1.1;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header Cookie $http_cookie;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location /admin/login/ {
+            try_files $uri $uri/ /admin/login/index.html;
+        }
+
         location /admin/ {
+            auth_request /_admin_auth;
+            error_page 401 = @admin_login_redirect;
             try_files $uri $uri/ /admin/index.html;
         }
 
@@ -57,10 +81,103 @@ http {
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
+        location = /api/admin/login {
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Cookie $http_cookie;
+        }
+
+        location = /api/admin/logout {
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Cookie $http_cookie;
+        }
+
+        location = /api/admin/session {
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Cookie $http_cookie;
+        }
+
+        location /api/admin/ {
+            auth_request /_admin_auth;
+            error_page 401 = @admin_api_unauthorized;
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Cookie $http_cookie;
+        }
+
+        location /api/ {
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location = /metrics {
+            set $chat_upstream http://chat:3000;
+            proxy_pass $chat_upstream;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location @admin_api_unauthorized {
+            add_header Content-Type application/json;
+            return 401 '{"error":"unauthorized"}';
+        }
+
+        location @admin_login_redirect {
+            return 302 /admin/login/;
+        }
+
+        location = /hls/playlist.m3u8 {
+            alias /srv/hls/playlist.m3u8;
+            add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0";
+            add_header Access-Control-Allow-Origin "*";
+        }
+
+        location = /hls/init.mp4 {
+            alias /srv/hls/init.mp4;
+            add_header Cache-Control "public, max-age=31536000, immutable";
+            add_header Access-Control-Allow-Origin "*";
+        }
+
+        location ~* ^/hls/(.+\.(ts|m4s))$ {
+            alias /srv/hls/$1;
+            add_header Cache-Control "public, max-age=31536000, immutable";
+            add_header Access-Control-Allow-Origin "*";
+        }
+
         # Local/dev fallback HLS origin. Production media should use MEDIA_DOMAIN.
         location /hls/ {
             alias /srv/hls/;
-            add_header Cache-Control "public, max-age=3600";
+            add_header Cache-Control "public, max-age=60";
             add_header Access-Control-Allow-Origin "*";
         }