fix(admin): console requests challenge with POST, matching the route

The SPA issued GET /admin/auth/challenge but the route is POST (nonce
issuance is a write). Left as-is the login flow 405'd at step one. Fixed
the client verb and rebuilt dist.

admin-ui/dist/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta name="robots" content="noindex" />
     <title>Smirk Operator Console</title>
-    <script type="module" crossorigin src="/admin/assets/index-DLOlKNyc.js"></script>
+    <script type="module" crossorigin src="/admin/assets/index-4xN7Sa3G.js"></script>
     <link rel="stylesheet" crossorigin href="/admin/assets/index-uKG4VNAS.css">
   </head>
   <body>

admin-ui/src/api.ts

@@ -56,7 +56,9 @@ export interface InviteView {
 }
 
 export const api = {
-  challenge: () => req('GET', '/admin/auth/challenge') as Promise<ChallengeResp>,
+  // POST (not GET): issuing a single-use nonce is a write, and must never be
+  // cached or prefetched. Matches the route wired in src/api/admin.rs.
+  challenge: () => req('POST', '/admin/auth/challenge', {}) as Promise<ChallengeResp>,
   verify: (admin_token: string, challenge: string) =>
     req('POST', '/admin/auth/verify', { admin_token, challenge }) as Promise<TokenResp>,
   logout: () => req('POST', '/admin/auth/logout', {}),