Ping our own API for auth check, not auth backend (forward auth).

AGENTS.md

@@ -97,13 +97,15 @@ not for the public pages. See `docs/design-principles.md` for the design.
     - `pagerite.js` — public page entry; runs fetch-navigation, scroll-reveal,
       brand shrink-to-fit (the themed size is the maximum; JS reduces the
       font-size so a long brand or narrow viewport still fits one line),
-      code copy buttons, and the auth check: it fetches
+      code copy buttons, and the auth check: it probes `GET /_api/settings`
-      `/auth/api/validate?perm=pagerite:admin` and only then injects the 🖊️
+      and only then injects the 🖊️ edit pens (asset URLs from the
-      edit pens (asset URLs from the `pagerite:editor-src`/`-css` meta tags);
+      `pagerite:editor-src`/`-css` meta tags). The same reverse proxy that
-      a 401 adds a "log in" link to `/auth/` in the banner corner, a 403
+      gates `/_api` returns 401 for anonymous users, 403 for users without
-      nothing, and any other result (no auth server, e.g. dev) leaves
+      the admin permission, and 200 for admins; a 401 adds a "log in" link
-      editing open. Pages themselves render identically for everyone; the
+      to `/auth/` in the banner corner, a 403 nothing, and any other
-      real gate is the auth proxy in front of all of `/_api`. The backend links the shared CSS as two separate
+      result (no auth proxy, e.g. dev) leaves editing open. Pages themselves
+      render identically for everyone; the real gate is the auth proxy in
+      front of all of `/_api`. The backend links the shared CSS as two separate
       stylesheets (base and theme) so they can be swapped or augmented.
     - `assets/` — shared styles and data files built by Vite and served hashed
       under `/_assets/`: `pagerite.css` (base layout + conservative variables),

frontend/src/pagerite.js

@@ -28,11 +28,13 @@
 
   // --- Auth-gated edit pens ---------------------------------------------
   // Pages render identically for everyone; the 🖊️ pens are injected by JS
-  // only after the auth server validates the session (perm pagerite:admin).
+  // only after we know the user has pagerite:admin access. We probe our own
+  // /_api/settings endpoint: the same reverse proxy that gates /_api returns
+  // 401/403 here, and a 200 means the permission is present.
   // 401 = anonymous: show a small login link in the banner corner instead.
   // 403 = logged in without the permission: no pens. Any other outcome
-  // (404, network error — i.e. no auth server deployed, as in dev) leaves
+  // (network error — i.e. no auth proxy deployed, as in dev) leaves editing
-  // editing open as before: the real gate is the proxy in front of /_api.
+  // open as before: the real gate is the proxy in front of /_api.
   let authorized = false;
   let editorMeta = null;
 
@@ -78,9 +80,9 @@
     };
     let status = 0;
     try {
-      status = (await fetch("/auth/api/validate?perm=pagerite:admin")).status;
+      status = (await fetch("/_api/settings")).status;
     } catch {
-      // Auth server unreachable: treat as not deployed.
+      // Auth proxy unreachable: treat as not deployed.
     }
     if (status === 401) addLoginLink();
     else if (status !== 403) {