Someone hitting the deployed instance recently reported the wallet-auth
front-end as broken based on two mistakes:
(a) mistook the 510-byte login shell for a stub (it's an SPA bootstrap
that renders the UI via a JS module client-side), and
(b) tried /static/wallet.js instead of /auth/static/wallet.js, missing
the Caddy path-prefix routing.
Add an explicit section with:
- URL table showing exactly which service serves each path
- curl snippets for smoke-testing the flow without a browser
- Note that /api/v1/user requires an API token (not a session cookie),
so a 401 there does not mean "not signed in"
- Guidance for headless / AI-driven browser sessions
Aims to head off the same misdiagnosis pattern from future sessions.