Gate note-writing UI behind login

Adding a note (either tool) always ended in a 401 for a logged-out
viewer — the write-only affordance just wasn't hidden yet, unlike
GpxPanelControl's own upload/new-folder buttons, which already are.

NotesControl isn't added to the map at all when logged out (its whole
purpose is writing); MeasureControl's "Save as note" button is hidden
but the tool itself stays usable for plain measuring either way.

public/js/map.js

@@ -14,6 +14,7 @@ import { NotesControl } from "/js/notes.js";
 import { LocateControl } from "/js/locate.js";
 import { LAYERS_ICON, HILLSHADE_ICON } from "/js/icons.js";
 import { notifySidePanelOpen, onlyOneSidePanelOpen } from "/js/panels.js";
+import { isLoggedIn } from "/js/auth.js";
 import HomeButton from "/vendor/npmap-home-button/home-button.esm.js";
 import OverviewMap from "/vendor/npmap-overview/overview.esm.js";
 import * as maplibregl from "/vendor/maplibre-gl/maplibre-gl.mjs";
@@ -501,7 +502,11 @@ map.addControl(new HomeButton({ bounds: SLOVAKIA_BOUNDS }), "top-left");
 map.addControl(new NavigationControl({ showCompass: false }), "top-left");
 map.addControl(new ZoomLevelControl(), "top-left");
 map.addControl(new MeasureControl(), "top-left");
-map.addControl(new NotesControl(), "top-left");
+// Writing a note needs a login (POST /api/gpx/notes) — no point adding a
+// button that can only ever end in a 401 for a logged-out viewer, same
+// "hide the write-only affordance" story as GpxPanelControl's own
+// upload/new-folder buttons.
+if (isLoggedIn()) map.addControl(new NotesControl(), "top-left");
 // Constructed here (rather than down where it's mounted, alongside the
 // other sidebar controls) so LocateControl can hold the same instance —
 // its constructor only touches `map`, mount() (which needs the sidebar