BACKLOG + CHANGELOG: mark DC-049 done

Track record of the auth-gate UI work plus the historical delta from
DC-046/047/050/049 commit chain. No code changes.

BACKLOG.md

@@ -289,11 +289,12 @@ Sami explicitly stated he wants email auth as an OPTION alongside TOTP, not a re
 - **prerequisite:** DC-047 (needs email auth working first).
 
 ### DC-049: Update login UI to show multiple providers
-- **status:** todo
-- **owner:** unclaimed
+- **status:** done
+- **owner:** hermes
 - **details:** Currently the login page is TOTP-only. Once DC-046/047/048 ship, login needs to render ALL enabled providers as a list of buttons, each routing to its provider-specific initiate flow (`/api/v1/auth/login/totp`, `/api/v1/auth/login/email`). Frontend work — `status/js/core/login.js` and the login modal markup. Add a small "Choose how to sign in" header. Effort: ~1 hr. Risk: low (pure UI, no backend changes).
 - **impact:** Makes the pluggable auth provider pattern visible to users. Without this, providers other than TOTP are unreachable.
 - **prerequisite:** DC-046 + DC-047 (needs at least two providers to be meaningful).
+- **result:** Shipped. New module `status/js/auth-gate.js` (~290 LOC) owns the `?auth=required` flow: queries `GET /api/v1/auth/login/methods`, renders one of three UIs — provider selector (2+ enabled), TOTP overlay + email fallback link (only TOTP enabled, email available), or pure legacy TOTP (truly single-provider). `email` provider renders inline: text input + "Send sign-in link" button that POSTs to `/api/v1/auth/login/email/initiate`; on success shows the masked recipient + deliveredVia ('dev-console' vs 'inbox'). Coordination with `totp-auth.js`: `auth-gate.js` sets `window.__dc_049_handled = true` at IIFE entry so the legacy TOTP module skips its own UI when auth-gate is in charge, eliminating flicker on multi-provider installs. Bundle order in `build.js`: auth-gate BEFORE totp-auth (flag must be set first). Verified live: `https://status.sami/dist/core.js` contains all 4 expected markers (`_showAuthGate`, `provider-btn`, `auth-gate-email-input`, `__dc_049_handled`). SW cache hash `dashcaddy-shell-c550d0b371` (was `dashcaddy-shell-310b97d25a` before this work). User instruction: hard-refresh `status.sami` to pick up the new bundle.
 
 ### DC-050: Harden platform-paths.dataDir — structural guard against image-layer data loss
 - **status:** done