fix: add /api/users/login route alias for frontend compat; return JSON error for unmatched API routes instead of SPA index.html

src/routes/auth.rs

@@ -52,6 +52,7 @@ pub fn routes() -> Router<AppState> {
     Router::new()
         .route("/api/auth/register", post(register))
         .route("/api/auth/login", post(login))
+        .route("/api/users/login", post(login))
         .route("/api/auth/me", get(me))
         .route("/api/users/me", patch(update_me))
         .route("/api/users/me/password", post(change_password))

src/routes/mod.rs

@@ -64,6 +64,22 @@ pub fn build_router(state: AppState) -> Router {
         .fallback(service_fn(move |req: Request<Body>| {
             let web_dir = web_dir_owned.clone();
             async move {
+                let path = req.uri().path();
+
+                // API routes that don't match → return JSON error, not index.html
+                if path.starts_with("/api/") || path.starts_with("/v1/") {
+                    return Ok::<_, Infallible>(
+                        Response::builder()
+                            .status(StatusCode::NOT_FOUND)
+                            .header("Content-Type", "application/json; charset=utf-8")
+                            .body(Body::from(
+                                serde_json::json!({"error": "Not found", "path": path}).to_string(),
+                            ))
+                            .unwrap(),
+                    );
+                }
+
+                // SPA fallback: serve index.html for client-side routing
                 let index_path = format!("{}/index.html", web_dir);
                 match tokio::fs::read_to_string(&index_path).await {
                     Ok(html) => {
@@ -80,7 +96,7 @@ pub fn build_router(state: AppState) -> Router {
                             Response::builder()
                                 .status(StatusCode::NOT_FOUND)
                                 .header("Content-Type", "text/plain; charset=utf-8")
-                                .body(Body::from(format!("404: {} not found", req.uri().path())))
+                                .body(Body::from(format!("404: {} not found", path)))
                                 .unwrap(),
                         )
                     }