[zumbrunn]

Fixes #159

site.yaml: auth.login_path: /join (default /auth/login).

• Redirects to login go to login_path with ?next=: the page gate, a logged-out visitor opening a gated file (mediaDenialResponse), a failed password login (?error=invalid), and the "Try again" link on the magic-link error page.
• GET /auth/login redirects to login_path (query kept), so there is one login page. Not redirected when login_path is unset or /auth/login, so no loop.
• Still mounted under /auth/*: POST /auth/login, OAuth callbacks, magic-link send/verify, logout. The custom page posts to them.
• Validation: login_path must be a local absolute path: one leading /, plain path characters, no //host, URL, query, fragment or ... Config validation rejects anything else; at runtime an invalid value falls back to /auth/login.
• No self-loop on a gated site: the page whose route is login_path is treated as roles: public by the inheritance pass, so neither auth.default_roles nor a gated ancestor can gate it. Its own roles: still applies.

How it is wired: gating has no config access, so mountDuneAuth registers the path per origin (setGatingLoginPath, same pattern as setGatingAuthz) and enforceRoles reads it with loginPathForRequest(req).

Not in this PR

• Docs: a "Login redirect" section on 17.authentication/02.content-gating and a config-reference row for login_path, after the release (dune-docs#30 is held until then).
• The theme login template and the OAuth buttons are untouched; a custom page links to /auth/{provider} itself.

Testing

8 new tests (tests/auth/login_path_test.ts): path validation, config validation, gate and media redirects including per-origin selection, the default-roles exemption (and the loop it prevents), GET /auth/login redirect with query, no redirect when unset or equal to /auth/login, password failure redirect, magic-link error link. tests/auth, config, content, runtime: 625 pass; deno check and deno lint src clean. Not exercised in a browser.

Based on main after #158.

🤖 Generated with Claude Code