Send the admin login straight to Dex

A public custom script submits the OIDC form on /admin/login and CSS
hides the password form. /admin/login?local=1 (or a failed password
attempt) shows it for break-glass use; a 15s guard prevents loops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

files/public.js

@@ -0,0 +1,20 @@
+// eom.dev: the admin login goes straight to Dex.
+// Break-glass password login: /admin/login?local=1
+(function () {
+  if (window.location.pathname !== "/admin/login") return;
+  var local = new URLSearchParams(window.location.search).has("local");
+  var go = function () {
+    var root = document.documentElement;
+    // A failed password attempt re-renders /admin/login without ?local=1.
+    if (local || document.querySelector(".login .error")) { root.classList.add("eom-local-login"); return; }
+    var form = document.querySelector('form[action="/auth/oidc"]');
+    if (!form) return;
+    // Don't loop if Dex sent us straight back (e.g. login refused).
+    var key = "eom-oidc-redirect", now = Date.now(), last = 0;
+    try { last = Number(sessionStorage.getItem(key)) || 0; sessionStorage.setItem(key, String(now)); } catch (e) {}
+    if (now - last < 15000) return;
+    form.submit();
+  };
+  if (document.readyState === "loading") document.addEventListener("DOMContentLoaded", go);
+  else go();
+})();