feat: add basic auth protection to CMS editor

content-editor.js

@@ -356,7 +356,20 @@ if (toast) setTimeout(() => toast.remove(), 3500);
 
 // ── Server ───────────────────────────────────────────────────────────────────
 
+const CMS_USER = process.env.CMS_USER || 'admin';
+const CMS_PASS = process.env.CMS_PASS || 'mozdit2026';
+
 const server = http.createServer(async (req, res) => {
+  // Basic Auth verification
+  const b64auth = (req.headers.authorization || '').split(' ')[1] || '';
+  const [login, password] = Buffer.from(b64auth, 'base64').toString().split(':');
+
+  if (login !== CMS_USER || password !== CMS_PASS) {
+    res.writeHead(401, { 'WWW-Authenticate': 'Basic realm="mozdIT CMS"' });
+    res.end('Access denied');
+    return;
+  }
+
   const u = new URL(req.url, `http://localhost:${PORT}`);
   const fileKey = u.searchParams.get('file') || 'home';
   const activeFile = FILES[fileKey] ? fileKey : 'home';