Add honeypot field to login form: instant 24h IP ban on autofill

public/js/login.js

@@ -10,7 +10,7 @@ async function doLogin() {
     const res = await fetch(`${API}/api/auth/login`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ username, password }),
+      body: JSON.stringify({ username, password, website: document.getElementById('hpWebsite').value }),
     });
     const data = await res.json().catch(() => ({}));
     if (res.ok && data.token) {

public/login.html

@@ -25,6 +25,7 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
   <h1>Админ-панель</h1>
   <input type="text" id="userInput" placeholder="Логин" autocomplete="username" autofocus>
   <input type="password" id="pwdInput" placeholder="Пароль" autocomplete="current-password">
+  <input type="text" id="hpWebsite" tabindex="-1" autocomplete="off" style="display:none" value="">
   <button type="button" id="loginBtn">Войти</button>
   <div class="err" id="loginErr">Неверный логин или пароль</div>
   <div class="back"><a href="/">На главную</a></div>