[SandObserver]

Summary

• Add an optional login: { username, password } to badge and activity blocks, sent as an HTTP Basic Authorization header. A header row named Authorization overrides it.
• Scrub the password to passwordSet in config reads and exports, refill it on an unchanged save, and withhold it when the URL, username or TLS setting changes.
• Accept login on POST /api/badge-proxy and refill the stored password only for the saved destination and username.
• Add Username and Password rows under Authentication in the app form; the password row shows Configured or Not set and never pre-fills.
• Warn under the API URL when it contains user:pass@ and skip Fetch until it is removed, since the proxy does not send URL credentials.
• Add four strings in all six locales.

Testing
All green, e2e included. Added tests for the Basic header, scrub and preserve, withholding on URL or username change, the proxy refusing another host or username, the URL warning and the save path.

Changelog

Added

• Sign in to a live badge's API with a username and password.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.