Serve the frontend's config.js with the API password

The bundled frontend gets a token with API_PASSWORD from config.js. The server now
generates config.js from its own config, so setting API_PASSWORD on the server
container is enough.

internal/server/routes.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"encoding/json"
 	"net/http"
 
 	"music-server/cmd/web"
@@ -66,6 +67,7 @@ func (s *Server) routes() (*echo.Echo, apis) {
 	e.GET("/assets/*", echo.WrapHandler(http.FileServer(http.FS(web.Assets))))
 	e.GET("/search", echo.WrapHandler(templ.Handler(web.SearchForm())))
 	e.POST("/find", echo.WrapHandler(web.NewSearchHandler(s.search)))
+	e.GET("/config.js", s.frontendConfig)
 	e.Static("/", s.cfg.FrontendPath)
 
 	for _, r := range e.Router().Routes() {
@@ -74,6 +76,21 @@ func (s *Server) routes() (*echo.Echo, apis) {
 	return e, a
 }
 
+// frontendConfig serves the runtime config of the bundled frontend. The frontend uses
+// the API password to get a token, so anyone who can open the frontend can read it.
+func (s *Server) frontendConfig(c *echo.Context) error {
+	cfg, err := json.Marshal(map[string]string{
+		// Empty: the frontend calls this server with relative paths.
+		"API_HOSTNAME": "",
+		"API_PASSWORD": s.cfg.APIPassword,
+	})
+	if err != nil {
+		return err
+	}
+	c.Response().Header().Set("Cache-Control", "no-store")
+	return c.Blob(http.StatusOK, "text/javascript; charset=utf-8", []byte("window.__RUNTIME_CONFIG__ = "+string(cfg)+";\n"))
+}
+
 func redirect(to string) echo.HandlerFunc {
 	return func(c *echo.Context) error {
 		return c.Redirect(http.StatusMovedPermanently, to)