fix(auth): login loop — signin() wiped the stored token with the empty token-box

After redirecting from /login with the token in localStorage, signin() read the (empty) #tok gate
input and overwrote TOKEN with '', so /me 401'd → removeItem + bounce back to /login → loop. Now keeps
the stored token when the box is empty.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

site/admin.html

@@ -97,7 +97,7 @@ async function api(path){ const r = await fetch('/admin'+path, { headers: hdr()
 
 let ROLE = 'staff';
 async function signin(){
-  TOKEN = $('#tok') ? $('#tok').value.trim() : TOKEN;
+  TOKEN = ($('#tok') && $('#tok').value.trim()) || TOKEN;   // keep the stored token if the box is empty
   let me; try { me = await api('/me'); } catch(e){ localStorage.removeItem('rg_token'); location.replace('/login'); return; }
   ROLE = me.role || 'staff';
   localStorage.setItem('rg_token', TOKEN);