Serve the frontend's config.js with the API password

The bundled frontend gets a token with API_PASSWORD from config.js. The server now
generates config.js from its own config, so setting API_PASSWORD on the server
container is enough.

internal/server/routes_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"net"
 	"net/http"
+	"path/filepath"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -142,6 +143,17 @@ func TestSearchPageAndFrontend(t *testing.T) {
 	assert.Contains(t, rec.Body.String(), "frontend")
 }
 
+func TestFrontendConfigHasAPIPassword(t *testing.T) {
+	e := newTestEnv(t, func(c *config.Config) { c.APIPassword = `pa'ss"word` })
+	writeFile(t, filepath.Join(e.cfg.FrontendPath, "config.js"), "stale")
+
+	rec := e.do(http.MethodGet, "/config.js")
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.Equal(t, "text/javascript; charset=utf-8", rec.Header().Get("Content-Type"))
+	assert.Equal(t, "no-store", rec.Header().Get("Cache-Control"))
+	assert.Equal(t, `window.__RUNTIME_CONFIG__ = {"API_HOSTNAME":"","API_PASSWORD":"pa'ss\"word"};`+"\n", rec.Body.String())
+}
+
 func TestShutdownWaitsForRequestsBeforeClosingDatabase(t *testing.T) {
 	e := newTestEnv(t)
 	started := make(chan struct{})