Require auth for the web UI, keep the JSON API open

Sites/Social Accounts/Posts pages now require login; add a Login
Livewire component, guest layout, and logout action. routes/api.php
is untouched, per AI_API.md's documented no-auth-by-design contract.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

routes/web.php

@@ -1,14 +1,28 @@
 <?php
 
+use App\Livewire\Auth\Login;
 use App\Livewire\Posts\Index as PostsIndex;
 use App\Livewire\Sites\Index as SitesIndex;
 use App\Livewire\SocialAccounts\Index as SocialAccountsIndex;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/', function () {
     return view('welcome');
 });
 
-Route::get('/sites', SitesIndex::class)->name('sites.index');
-Route::get('/social-accounts', SocialAccountsIndex::class)->name('social-accounts.index');
-Route::get('/posts', PostsIndex::class)->name('posts.index');
+Route::get('/login', Login::class)->middleware('guest')->name('login');
+
+Route::post('/logout', function () {
+    Auth::guard('web')->logout();
+    request()->session()->invalidate();
+    request()->session()->regenerateToken();
+
+    return redirect('/login');
+})->middleware('auth')->name('logout');
+
+Route::middleware('auth')->group(function () {
+    Route::get('/sites', SitesIndex::class)->name('sites.index');
+    Route::get('/social-accounts', SocialAccountsIndex::class)->name('social-accounts.index');
+    Route::get('/posts', PostsIndex::class)->name('posts.index');
+});