[Bug]: Remote login displays codenomad as a placeholder but submits an empty username #616

App Variant

Tauri

Operating System & Version

Windows 11 Pro 10.0.26200 (build 26200)

CodeNomad Version

0.18.0

Issue Summary

The remote login page visually displays the default username (codenomad), but it is only placeholder text. The input's actual value is empty, so entering a password and pressing Continue does not submit the displayed username. This is especially misleading on a phone, where the field appears to have already been populated.

Steps to Reproduce

1. In the Tauri app, enable Allow connections from other IPs and configure a server password.
2. From another device, open one of the HTTPS remote-access addresses (reproduced over Tailscale).
3. Observe that the username field appears to show codenomad.
4. Enter the configured password without manually retyping the apparently populated username.
5. Press Continue.
6. Authentication does not proceed because the username input's value is empty.
7. Manually type codenomad into the username field and submit again; login succeeds.

Expected Behavior

The displayed default username should be the input's actual value, so the form submits codenomad unless the user intentionally changes it.

Root Cause

In packages/server/src/server/routes/auth-pages/login.html, the username is rendered only as a placeholder:

<input id="username" autocomplete="username" placeholder="{{DEFAULT_USERNAME}}" value="" />

The submit handler reads the value rather than the placeholder:

const username = $("username").value.trim()

Consequently, the username is empty even though the page appears to display codenomad.

Proposed Solution

Populate the actual value and disable mobile text transformations on credential fields:

<input
  id="username"
  autocomplete="username"
  autocapitalize="none"
  autocorrect="off"
  spellcheck="false"
  placeholder="{{DEFAULT_USERNAME}}"
  value="{{DEFAULT_USERNAME}}"
/>

<input
  id="password"
  type="password"
  autocomplete="current-password"
  autocapitalize="none"
  autocorrect="off"
  spellcheck="false"
  value=""
/>

I applied this change locally to both the source template and installed server resource. Login was then verified successfully from a phone through the Tailscale address. No password hashing, cookie, or network behavior needs to change.

Additional Context

This is distinct from #128, which concerned LAN authentication/session behavior over HTTP. In this case HTTPS connectivity and the password were valid; explicitly entering the username made the same login succeed.