fix: OAuth login works inside HF Space iframe

- Login link uses target="_top" to break out of iframe
- /editor redirect uses window.top.location instead of server redirect

Made-with: Cursor

backend/src/server.ts

@@ -285,7 +285,7 @@ function sendLoginPage(res: express.Response) {
   <div class="card">
     <h1>This article is not yet published</h1>
     <p>Log in with your Hugging Face account to access the editor.</p>
-    <a class="btn" href="/oauth/authorize">Sign in with Hugging Face</a>
+    <a class="btn" href="/oauth/authorize" target="_top">Sign in with Hugging Face</a>
   </div>
 </body>
 </html>`);
@@ -302,8 +302,10 @@ if (existsSync(staticDir)) {
       const user = await resolveUser(token);
 
       if (!user || !user.canEdit) {
-        // Not logged in or no write access → redirect to OAuth login
-        res.redirect(`/oauth/authorize`);
+        // Not logged in or no write access → break out of iframe to OAuth
+        res.status(200).send(`<!DOCTYPE html>
+<html><head><script>window.top.location.href="/oauth/authorize";</script></head>
+<body>Redirecting to login...</body></html>`);
         return;
       }
     }