loginPage
A self-contained HTML login page the tunnel serves in front of an app that
does not embed the <AuthGate> React component (e.g. a WebSocket app fronted
by the CLI proxy).
It speaks the same compatibility endpoints under AUTH_PREFIX that the
React client uses — POST /request to email a code, POST /verify to
exchange it for the dbx-tools-auth session cookie — with plain fetch, no
build step and no dependency. Passkeys are intentionally omitted: the WebAuthn
ceremony needs the better-auth client library, so passkey enrollment happens
inside the app after this email-OTP sign-in. On success the page reloads, and
the now-authenticated request reaches the app.