feat: lock auth-only tiles on the welcome page (no more blank 401s) (#12)

The welcome page links to /profile/, /public/, /private/, /inbox/,
/settings/ — but the last three require auth. Without a session
cookie, clicking those tiles previously dropped the user on a blank
401 (zero-byte body). Confusing.

On page load, each tile is HEAD-probed. On a 401/403 the tile is
dimmed (opacity .55, no hover-darken) and its href is rewritten to
./idp so a click routes the user to the sign-in flow instead of a
blank screen. After sign-in, refreshing the welcome page re-probes
and the tiles unlock automatically.

The probe runs alongside the existing Sign in / Sign up reveal
(same HEAD-probe pattern). No JSS change required.

Bumps jspod to 0.0.14.

Author: melvincarvalho

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jspod",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "description": "JavaScript Solid Pod - Just works, batteries included",
   "type": "module",
   "main": "index.js",

welcome.html

@@ -24,6 +24,8 @@
 .dirs{list-style:none;padding:0;margin:1em 0 0;display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:.5em}
 .dirs li a{display:block;padding:.7em .9em;background:#f3eee5;border-radius:8px;color:#222}
 .dirs li a:hover{background:#ebe5d8}
+.dirs li a.locked{opacity:.55;cursor:default}
+.dirs li a.locked:hover{background:#f3eee5}
 footer{margin-top:1.5em;padding-top:1em;border-top:1px solid #eee;color:#888;font-size:.85em;text-align:center}
 </style>
 </head>
@@ -69,6 +71,21 @@ <h1>Your Solid pod</h1>
     else if(res.status===403){if(l)l.hidden=false;}
   }).catch(function(){});
 })();
+(function(){
+  // Probe each directory tile. If unauthenticated (401/403), dim it
+  // and redirect its click to the sign-in flow instead of letting the
+  // browser navigate into a blank 401 response body.
+  document.querySelectorAll('.dirs a').forEach(function(a){
+    var href=a.getAttribute('href');
+    fetch(href,{method:'HEAD',cache:'no-store'}).then(function(res){
+      if(res.status===401||res.status===403){
+        a.classList.add('locked');
+        a.title='Sign in to view '+href;
+        a.setAttribute('href','./idp');
+      }
+    }).catch(function(){});
+  });
+})();
 </script>
 </body>
 </html>