fix: use target=_blank for OAuth login (sandboxed iframe)

HF Space iframe doesn't allow top-navigation. Use target="_blank"
to open OAuth flow in a new tab as recommended by HF docs.
After login, the callback redirects to /editor in that new tab.

Made-with: Cursor

backend/src/server.ts

@@ -292,7 +292,7 @@ function sendLoginPage(res: express.Response) {
   <div class="card">
     <h1>This article is not yet published</h1>
     <p>Log in with your Hugging Face account to access the editor.</p>
-    <a class="btn" href="/oauth/authorize" target="_top">Sign in with Hugging Face</a>
+    <a class="btn" href="/oauth/authorize" target="_blank">Sign in with Hugging Face</a>
   </div>
 </body>
 </html>`);
@@ -309,10 +309,19 @@ if (existsSync(staticDir)) {
       const user = await resolveUser(token);
 
       if (!user || !user.canEdit) {
-        // Not logged in or no write access → break out of iframe to OAuth
+        // Not logged in or no write access → show login prompt
+        // Can't navigate top frame from sandboxed iframe, so show a button
         res.status(200).send(`<!DOCTYPE html>
-<html><head><script>window.top.location.href="/oauth/authorize";</script></head>
-<body>Redirecting to login...</body></html>`);
+<html lang="en">
+<head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/>
+<title>Sign in required</title>
+<style>*{margin:0;padding:0;box-sizing:border-box}body{display:flex;align-items:center;justify-content:center;height:100vh;font-family:system-ui,-apple-system,sans-serif;background:#0a0a0a;color:#aaa}.card{text-align:center;max-width:420px;padding:2rem}h1{color:#fff;font-size:1.5rem;margin-bottom:.5rem}p{margin-bottom:1.5rem;line-height:1.5}a.btn{display:inline-block;padding:.6rem 1.5rem;border-radius:8px;background:#958DF1;color:#fff;text-decoration:none;font-weight:500;transition:opacity .15s}a.btn:hover{opacity:.85}</style></head>
+<body><div class="card">
+<h1>Editor access</h1>
+<p>Sign in with your Hugging Face account to start editing.</p>
+<a class="btn" href="/oauth/authorize" target="_blank">Sign in with Hugging Face</a>
+<p style="margin-top:1rem;font-size:.85rem;color:#666">After signing in, come back and <a href="/editor" style="color:#958DF1">refresh this page</a>.</p>
+</div></body></html>`);
         return;
       }
     }