Send the admin login straight to Dex

A public custom script submits the OIDC form on /admin/login and CSS
hides the password form. /admin/login?local=1 (or a failed password
attempt) shows it for break-glass use; a 15s guard prevents loops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

files/public.css

@@ -71,3 +71,6 @@ input::placeholder { color: var(--muted); }
 .button.button-outline:hover { background: var(--surface); color: var(--accent-hover); }
 .error { color: var(--error); }
 .pg-page.pg-selected { background: var(--accent); color: var(--on-accent); }
+/* Admin login is Dex only; ?local=1 (public.js) reveals the password form. */
+.login form[action="/admin/login"], .login .center.small { display: none; }
+.eom-local-login .login form[action="/admin/login"], .eom-local-login .login .center.small { display: block; }

files/public.js

@@ -0,0 +1,20 @@
+// eom.dev: the admin login goes straight to Dex.
+// Break-glass password login: /admin/login?local=1
+(function () {
+  if (window.location.pathname !== "/admin/login") return;
+  var local = new URLSearchParams(window.location.search).has("local");
+  var go = function () {
+    var root = document.documentElement;
+    // A failed password attempt re-renders /admin/login without ?local=1.
+    if (local || document.querySelector(".login .error")) { root.classList.add("eom-local-login"); return; }
+    var form = document.querySelector('form[action="/auth/oidc"]');
+    if (!form) return;
+    // Don't loop if Dex sent us straight back (e.g. login refused).
+    var key = "eom-oidc-redirect", now = Date.now(), last = 0;
+    try { last = Number(sessionStorage.getItem(key)) || 0; sessionStorage.setItem(key, String(now)); } catch (e) {}
+    if (now - last < 15000) return;
+    form.submit();
+  };
+  if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", go);
+  else go();
+})();