Add missing login page and fix auth loop

- /login route did not exist, so /admin redirected to /api/login -> /login -> 404
- /api/auth/user still ran the Replit-era deterministic UUID hash on the session
  id, so it never found the user; now reads the session directly
- admin logout posts to /api/auth/logout and returns to /login

server/routes.ts

@@ -1684,28 +1684,12 @@ Sitemap: ${baseUrl}/sitemap.xml
   // ===== ADMIN ROUTES =====
   
   // Auth route to get current user
-  app.get('/api/auth/user', isAuthenticated, async (req: any, res) => {
+  app.get('/api/auth/user', authenticate, async (req, res) => {
     try {
-      // Import the generateDeterministicUUID function from replitAuth
-      const { createHash } = await import('crypto');
-      const generateDeterministicUUID = (replitId: string): string => {
-        const hash = createHash('sha256').update(`replit_${replitId}`).digest('hex');
-        return [
-          hash.substring(0, 8),
-          hash.substring(8, 12),
-          '4' + hash.substring(13, 16),
-          (parseInt(hash.substring(16, 17), 16) & 0x3 | 0x8).toString(16) + hash.substring(17, 20),
-          hash.substring(20, 32)
-        ].join('-');
-      };
-      
-      const userId = generateDeterministicUUID(req.user.claims.sub);
-      const user = await storage.getUser(userId);
+      const user = await storage.getUser(req.session.userId!);
       if (!user) {
         return res.status(404).json({ message: "User not found" });
       }
-      
-      // Remove sensitive data
       const { passwordHash, ...userResponse } = user;
       res.json(userResponse);
     } catch (error) {