fix: inject token as JS global (no sessionStorage needed), skip bridge.php, direct login→app

public_html/login.php

@@ -20,7 +20,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             $_SESSION['jarvis_user_id'] = $user['id'];
             $_SESSION['jarvis_name']    = $user['display_name'];
             $pdo->prepare('UPDATE users SET last_seen=NOW() WHERE id=?')->execute([$user['id']]);
-            header('Location: /bridge.php');
+            header('Location: /');
             exit;
         }
         $error = 'ACCESS DENIED';