feat: client auth — login/password flow, auto device reg, sync interval + improved sync UI

internal/core/sync/client.go

@@ -45,6 +45,40 @@ func (c *Client) RegisterDevice(name string) (apiKey string, err error) {
 	return resp.APIKey, nil
 }
 
+// RegisterDeviceWithAuth registers a device with user credentials.
+func (c *Client) RegisterDeviceWithAuth(name, username, password string) (deviceID, apiKey string, err error) {
+	body := map[string]string{"name": name, "username": username, "password": password}
+	var resp struct {
+		DeviceID string `json:"device_id"`
+		APIKey   string `json:"api_key"`
+	}
+	// Temporarily clear API key for this request (server expects login/password, not API key).
+	savedKey := c.APIKey
+	c.APIKey = ""
+	err = c.post("/api/v1/device/register", body, &resp)
+	c.APIKey = savedKey
+	if err != nil {
+		return "", "", err
+	}
+	return resp.DeviceID, resp.APIKey, nil
+}
+
+// Login authenticates with user credentials and returns a session token.
+func (c *Client) Login(username, password string) (token string, err error) {
+	body := map[string]string{"username": username, "password": password}
+	var resp struct {
+		Token string `json:"token"`
+	}
+	savedKey := c.APIKey
+	c.APIKey = ""
+	err = c.post("/api/v1/auth/login", body, &resp)
+	c.APIKey = savedKey
+	if err != nil {
+		return "", err
+	}
+	return resp.Token, nil
+}
+
 // PushRequest is the payload for POST /sync/push.
 type PushRequest struct {
 	DeviceID string     `json:"device_id"`