fix: bypass Cloudflare Rocket Loader on admin script — doLogin was undefined at click time

data-cfasync=false prevents Rocket Loader from deferring the main script block.
Also added try/catch + button feedback to doLogin so errors show visibly.

public_html/admin/index.php

@@ -943,7 +943,7 @@ select.filter-sel:focus{border-color:var(--cyan)}
 
 <div id="toast"></div>
 
-<script>
+<script data-cfasync="false">
 // ── UTILS ─────────────────────────────────────────────────────────────────────
 let _alertFilter = 'active';
 let _modalCb = null;
@@ -993,15 +993,22 @@ function statusBadge(s) {
 
 // ── AUTH ──────────────────────────────────────────────────────────────────────
 async function doLogin() {
+  const btn=document.querySelector('#loginBox .btn');
+  const err=document.getElementById('loginErr');
   const u=document.getElementById('lu').value.trim(), p=document.getElementById('lp').value;
+  if (!u||!p){err.textContent='Enter username and password';return;}
+  btn.disabled=true; btn.textContent='AUTHENTICATING...'; err.textContent='';
+  try {
     const fd=new FormData(); fd.append('action','login'); fd.append('username',u); fd.append('password',p);
     const r = await fetch(location.href,{method:'POST',body:fd});
     const d = await r.json();
-  if (d.error) { document.getElementById('loginErr').textContent=d.error; return; }
+    if (d.error) { err.textContent=d.error; return; }
     document.getElementById('loginWrap').style.display='none';
     document.getElementById('app').style.display='flex';
     document.getElementById('adminUser').textContent = (d.name||u).toUpperCase();
     initApp();
+  } catch(e) { err.textContent='Connection error — try again'; }
+  finally { btn.disabled=false; btn.textContent='AUTHENTICATE'; }
 }
 
 async function doLogout() {