Initial commit: Brass & Sigil monorepo

Self-hosted Minecraft modpack distribution + administration system.

- launcher/  Avalonia 12 desktop client; single-file win-x64 publish.
             Microsoft auth via XboxAuthNet, manifest+SHA-1 mod sync,
             portable install path, sidecar settings.
- server/    brass-sigil-server daemon (.NET 8, linux-x64). Wraps the
             MC subprocess, embedded Kestrel admin panel with cookie
             auth + rate limiting, RCON bridge, scheduled backups,
             BlueMap CLI integration with player markers + skin proxy,
             friend-side whitelist request flow, world wipe with seed
             selection (keep current / random / custom).
- pack/      pack.lock.json (Modrinth + manual CurseForge entries),
             data-only tweak source under tweaks/, build outputs in
             overrides/ (gitignored).
- scripts/   Build-Pack / Build-Tweaks / Update-Pack / Check-Updates
             plus Deploy-Brass.ps1 unified one-shot deploy with
             version-bump pre-flight and daemon-state detection.

server/wwwroot/modules/api.js

@@ -0,0 +1,28 @@
+// Tiny JSON API helper used by every module.
+"use strict";
+
+export async function api(path, opts) {
+    const res = await fetch(path, opts);
+    if (res.status === 401) {
+        // Auth cookie missing or wrong. Surface to the auth module which
+        // shows the login overlay; the caller still gets an error so any
+        // calling code stops cleanly.
+        document.dispatchEvent(new CustomEvent("authrequired"));
+        throw new Error("Unauthorized");
+    }
+    if (!res.ok) throw new Error(`${path} → HTTP ${res.status}`);
+    return await res.json();
+}
+
+export async function apiJson(path, body, method = "POST") {
+    return api(path, {
+        method,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+    });
+}
+
+export function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, c =>
+        ({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[c]));
+}