Gate note-writing UI behind login

Adding a note (either tool) always ended in a 401 for a logged-out
viewer — the write-only affordance just wasn't hidden yet, unlike
GpxPanelControl's own upload/new-folder buttons, which already are.

NotesControl isn't added to the map at all when logged out (its whole
purpose is writing); MeasureControl's "Save as note" button is hidden
but the tool itself stays usable for plain measuring either way.

public/js/map.js

@@ -14,6 +14,7 @@ import { NotesControl } from "/js/notes.js";
 import { LocateControl } from "/js/locate.js";
 import { LAYERS_ICON, HILLSHADE_ICON } from "/js/icons.js";
 import { notifySidePanelOpen, onlyOneSidePanelOpen } from "/js/panels.js";
+import { isLoggedIn } from "/js/auth.js";
 import HomeButton from "/vendor/npmap-home-button/home-button.esm.js";
 import OverviewMap from "/vendor/npmap-overview/overview.esm.js";
 import * as maplibregl from "/vendor/maplibre-gl/maplibre-gl.mjs";
@@ -501,7 +502,11 @@ map.addControl(new HomeButton({ bounds: SLOVAKIA_BOUNDS }), "top-left");
 map.addControl(new NavigationControl({ showCompass: false }), "top-left");
 map.addControl(new ZoomLevelControl(), "top-left");
 map.addControl(new MeasureControl(), "top-left");
-map.addControl(new NotesControl(), "top-left");
+// Writing a note needs a login (POST /api/gpx/notes) — no point adding a
+// button that can only ever end in a 401 for a logged-out viewer, same
+// "hide the write-only affordance" story as GpxPanelControl's own
+// upload/new-folder buttons.
+if (isLoggedIn()) map.addControl(new NotesControl(), "top-left");
 // Constructed here (rather than down where it's mounted, alongside the
 // other sidebar controls) so LocateControl can hold the same instance —
 // its constructor only touches `map`, mount() (which needs the sidebar

public/js/measure.js

@@ -1,5 +1,6 @@
 import { RULER_ICON } from "/js/icons.js";
 import { NoteSaveForm } from "/js/notes.js";
+import { isLoggedIn } from "/js/auth.js";
 
 const SOURCE_ID = "measure";
 const LINE_LAYER_ID = "measure-line";
@@ -44,6 +45,10 @@ export class MeasureControl {
     this._controls = this._container.querySelector(".measure-panel__controls");
     this._result = this._container.querySelector(".measure-panel__result");
     this._saveButton = this._container.querySelector(".measure-panel__save");
+    // Same "hide the write-only affordance for a logged-out viewer" story
+    // as notes.js's own button not being added at all — Measure itself
+    // stays available either way, only saving needs a login.
+    if (!isLoggedIn()) this._saveButton.hidden = true;
 
     this._noteForm = new NoteSaveForm(this._panel, {
       onSaved: () => {