document.getElementById("loginForm").addEventListener("submit", async (e) => {
    e.preventDefault(); // verhindert Standard-Formular-Submit

    const username = document.getElementById("username").value;
    const password = document.getElementById("password").value;

    const res = await fetch("/login", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ username, password })
    });

    const data = await res.json();

    if (data.success) {
        window.location.href = data.redirect; // jetzt klappt die Weiterleitung
    } else {
        alert("Login fehlgeschlagen!");
    }
});