First commit, phased 1 and 2 created but untested

public/js/login.js

@@ -0,0 +1,21 @@
+document.addEventListener('DOMContentLoaded', () => {
+  const form = document.getElementById('login-form');
+  if (!form) return;
+
+  form.addEventListener('submit', async (e) => {
+    e.preventDefault();
+    const username = document.getElementById('username').value;
+    const password = document.getElementById('password').value;
+
+    try {
+      const data = await api.post('/auth/login', { username, password });
+      if (data.hasHero) {
+        window.location.href = '/game.html';
+      } else {
+        window.location.href = '/create-hero.html';
+      }
+    } catch (_) {
+      // Error already shown via api()
+    }
+  });
+});