app: Sign in with OTM button on the login page (v0.4.1)

The server fills the OTM link into login.html from OTM_SSO_AUDIENCE (the
route itself has been mounted since 0.4.0); without the env the block stays
hidden and the password form is unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014LCQmFvKshyAJsE8C3B5ET

app/server.mjs

@@ -521,6 +521,18 @@ const isOwner = async (session) => session?.operator
 
 const MIME = { ".html": "text/html", ".js": "text/javascript", ".css": "text/css",
   ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".webp": "image/webp", ".heic": "image/heic" };
+// The login page gets its "Sign in with OTM" link filled in here: the page is
+// static HTML, but the audience is per-instance env. No OTM wiring → the
+// placeholder stays empty and the page hides the block.
+function loginPage() {
+  const secret = (process.env.OTM_SSO_SECRET || "").trim();
+  const audience = process.env.OTM_SSO_AUDIENCE || "";
+  const url = secret && audience
+    ? `https://admin.poweredbyotm.com/sso/authorize?aud=${encodeURIComponent(audience)}&next=%2F`
+    : "";
+  return readFileSync(join(ROOT, "public", "login.html"), "utf8").replace("__OTM_SSO_URL__", url);
+}
+
 const PUBLIC_PATHS = new Set(["/api/health", "/api/login", "/login", "/login.html", "/api/auth/operator-magic", "/api/auth/otm-sso"]);
 
 createServer(async (req, res) => {
@@ -534,7 +546,7 @@ createServer(async (req, res) => {
     const isPublic = PUBLIC_PATHS.has(url.pathname);
 
     if (url.pathname === "/login" || url.pathname === "/login.html")
-      return send(200, readFileSync(join(ROOT, "public", "login.html")), "text/html");
+      return send(200, loginPage(), "text/html");
 
     if (!session && !isPublic) {
       if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/photos/") || url.pathname.startsWith("/file/"))