- site/hephaestus.x/index.html: replace single 'Sign in with wallet' CTA with
a <details> dropdown labelled 'Bitcoin Cash wallet'. Menu items:
Sign in -> /user/oauth2/hephaestus-wallet#import
Sign up -> /user/oauth2/hephaestus-wallet#create (pill: easiest)
WizardConnect -> /user/oauth2/hephaestus-wallet#connect (pill: most private)
Same emoji + copy scheme as the wallet accordion, so the landing previews
the choices the user will see after clicking through.
- Hephaestus/auth-proxy/public/wallet.js: renderTabs() now reads location.hash
and auto-opens the matching <details> option on load (create/import/connect).
Fragments survive Forgejo's OAuth redirect chain, so a click on 'Sign up'
from the landing lands the user directly on the Create accordion.
Clicking Create / Import / WizardConnect now expands the flow *inside* that
option (native <details>/<summary>) instead of hiding the picker and rendering
a separate view. Opening one option auto-closes the others. Chevron flips and
border turns accent-orange on the open card. "Back" buttons removed — closing
is a click on the same summary.
- wallet.js: renderTabs() emits three <details class="wallet-opt">; the
per-option flow content is populated lazily on first `toggle` and lives
inside `.wallet-flow` (no more global #panel). Accordion behavior is
enforced by closing sibling <details> on toggle.
- login.css: .wallet-opt reworked as details-summary card; chevron rotates
on [open]; .wallet-flow is the divider-topped body inside each card.
- login.css/wallet.js: replace 2-tab (generate/import) UX with 3 big options
— Create a new wallet [easiest], Import / add a wallet, Connect a wallet —
WizardConnect [most private] (Cashonize/Paytaca placeholder, "coming soon").
- Caddyfile (both hostnames): /user/login now 302→ /user/oauth2/hephaestus-wallet.
Escape hatch: /user/login?password=1 falls through to Forgejo's password form,
linked from the picker footer as "Prefer old-school? Sign in with username & password".
Behind Caddy's /auth/* → auth-proxy rewrite, absolute fetch('/challenge')
resolved to origin root and hit Forgejo instead of the auth-proxy, so every
real user got "challenge request failed" when clicking sign-in.
Same root cause as the earlier fix for the CSS/JS asset paths — relative
paths work under both direct (:4000) and prefixed (/auth/) mounts.
