feat: add Condo owner desk frontend and backend

backend/tests/auth.test.ts

@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { SessionManager } from "../src/auth.js";
+
+test("session manager expires and revokes opaque sessions", () => {
+  let now = Date.parse("2026-08-02T00:00:00.000Z");
+  const sessions = new SessionManager({
+    username: "operator",
+    password: "secret",
+    sessionTtlMs: 60_000,
+    cookieSecure: true
+  }, () => now);
+
+  assert.equal(sessions.credentialsMatch("operator", "secret"), true);
+  assert.equal(sessions.credentialsMatch("operator", "wrong"), false);
+  assert.equal(sessions.credentialsMatch("wrong", "secret"), false);
+
+  const created = sessions.create();
+  const cookie = sessions.sessionCookie(created.token);
+  assert.match(cookie, /^condon_session=[A-Za-z0-9_-]+;/);
+  assert.match(cookie, /HttpOnly/);
+  assert.match(cookie, /SameSite=Lax/);
+  assert.match(cookie, /Secure/);
+  assert.match(cookie, /Max-Age=60/);
+  assert.equal(cookie.includes("secret"), false);
+
+  const requestCookie = cookie.split(";", 1)[0];
+  assert.equal(sessions.get(requestCookie)?.username, "operator");
+  now += 60_001;
+  assert.equal(sessions.get(requestCookie), null);
+
+  const replacement = sessions.create();
+  const replacementCookie = sessions.sessionCookie(replacement.token).split(";", 1)[0];
+  sessions.revoke(replacementCookie);
+  assert.equal(sessions.get(replacementCookie), null);
+  assert.match(sessions.clearedCookie(), /Max-Age=0/);
+});