iOS Safari blocks window.location.href navigations after async fetch() calls because the user gesture chain is broken. Changed the ATAuth login page from fetch-based JavaScript to native HTML form submission — the server already handles non-JSON POSTs with 302 redirects. On error, re-renders the login page with the error message instead of returning plain text. Extracted login page HTML into reusable renderLoginPage() function.