document.getElementById("login-form").addEventListener("submit", async function (e) {
  e.preventDefault();
  const errEl = document.getElementById("login-error");
  errEl.textContent = "";

  const form = e.target;
  const username = form.username.value;
  const password = form.password.value;

  try {
    const res = await fetch("/api/login", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ username, password }),
    });
    if (!res.ok) {
      const data = await res.json().catch(() => ({}));
      errEl.textContent = data.error || "Anmeldung fehlgeschlagen.";
      return;
    }
    window.location.href = "/";
  } catch (err) {
    errEl.textContent = "Verbindung fehlgeschlagen.";
  }
});