Root cause: standalone login page checked localStorage for auto-redirect
to /, but the server checks the cookie. When a user had a stale localStorage
token but no valid cookie, they'd bounce between /login → / → /login.
Fixes:
- Standalone login: check COOKIE (not localStorage) for auto-redirect to /
- api.ts getToken(): fall back to cookie if localStorage is empty
- This ensures React app works after form-based login (which only sets cookie)
- Rebuilt frontend to include all changes
