feat: branded login screen in front of Basic Auth

The browser's native Basic Auth prompt can't be restyled — it's chrome UI,
not part of the page. Replace it with Aurum's own login screen: nginx keeps
auth_basic on /api/* (the actual protection, unchanged), but drops it from
the SPA shell (just HTML/JS/CSS, no data) so the app can render its own
branded form instead. On submit the app validates the credentials against a
real protected endpoint, then attaches the resulting Authorization header to
every request itself — sessionStorage-backed, so closing the tab signs out.
Instances with Basic Auth left off (the default) never see this screen.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01855PiW5Wd8n4aRW4n9kByY

frontend/nginx.conf

@@ -26,9 +26,13 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
 
-    # SPA fallback — client-side routing handles the rest.
+    # SPA fallback — client-side routing handles the rest. Deliberately NOT
+    # behind auth_basic: this is just the built HTML/JS/CSS shell, no
+    # financial data lives in it. The app's own branded login screen
+    # (frontend/src/components/auth/LoginGate.tsx) is what actually gates
+    # entry, by requiring a valid Authorization header on every /api/ call
+    # above — the real protection stays exactly where it was.
     location / {
-        include /etc/nginx/basic-auth.conf;
         try_files $uri $uri/ /index.html;
     }