Fix login, root route, hero redirect and game page API handling

src/app.js

@@ -45,6 +45,9 @@ function createApp() {
     res.json({ ok: true });
   });
 
+  // Root: send visitors to the login page (there is no index.html)
+  app.get('/', (_req, res) => res.redirect('/login.html'));
+
   // Auth routes (public)
   app.post('/api/auth/register', registerLimiter, authRoutes.postRegister);
   app.post('/api/auth/login', loginLimiter, authRoutes.postLogin);