randy
67585cd99a
GET /api/gnss/position now requires login (app.rb) -- it reveals where the receiver physically is, not something to leave open to anyone with the URL. GnssControl's sidebar icon is hidden entirely when logged out (same pattern as the tree UI's write controls) rather than shown and failing to ever get a fix. LocateControl needs no changes: it only ever reaches GNSS through GnssControl#isEnabled(), which can't turn true for a logged-out visitor if the toggle is never on the page to click. Its browser-geolocation fallback stays open to everyone -- a visitor's own device asking for their own location isn't something to gate. Extracted isLoggedIn() out of gpx.js into a shared public/js/auth.js (gnss.js needed the same check) rather than duplicating it. Verified: /api/gnss/position returns 401 logged out; the sidebar icon is actually hidden (computed display: none, not just present-but- unstyled -- checked properly this time after almost repeating the same present-vs-visible test mistake the .gpx-panel__action bug already taught).