Rename /login to /webadmin and reach it from every blog

The login URL is less guessable, bloggers can type /webadmin on their own
blog and get bounced to the root login page (and back to their dashboard
after logging in), and the public root blog no longer advertises the
admin entry point in its footer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A

1 files changed, 4 insertions, 2 deletions

diff --git a/internal/web/routes.go b/internal/web/routes.go
index 02d536a..e135229 100644
--- a/internal/web/routes.go
+++ b/internal/web/routes.go
@@ -10,8 +10,8 @@ func urlQuery(s string) string { return url.QueryEscape(s) }
 func (s *Server) rootRoutes() http.Handler {
 	m := http.NewServeMux()
 	m.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok")) })
-	m.HandleFunc("GET /login", s.handleLoginForm)
-	m.HandleFunc("POST /login", s.handleLogin)
+	m.HandleFunc("GET /webadmin", s.handleLoginForm)
+	m.HandleFunc("POST /webadmin", s.handleLogin)
 	m.HandleFunc("POST /logout", s.handleLogout)
 	m.HandleFunc("GET /dashboard", s.requireAuth(s.handleDashboard))
 	m.HandleFunc("GET /account/password", s.requireAuth(s.handlePasswordForm))
@@ -71,6 +71,8 @@ func (s *Server) blogRoutes(m *http.ServeMux, wrap func(http.HandlerFunc) http.H
 
 func (s *Server) subdomainRoutes() http.Handler {
 	m := http.NewServeMux()
+	// Bloggers type /webadmin on their own blog; send them to the real login page.
+	m.HandleFunc("GET /webadmin", s.handleWebadminRedirect)
 	m.HandleFunc("GET /media/{id}", s.handleMedia)
 	m.Handle("GET /static/{file}", s.staticHandler())
 	s.blogRoutes(m, s.hostBlog)