fix(web): keep server storage off the startup bundle; form-field defaults on sign-in

PwaService imported isBackendUrl from the @iptvnator/services/server-storage
barrel, which pulled the whole storage subsystem (sync, migration, API
client) into main, though server mode loads it by dynamic import. The
helper now lives with the token helpers in @iptvnator/services
(re-exported from the interceptor): renderer.initialBytes 1,392,902 ->
1,357,795 bytes locally.

The remaining 11,988 bytes over #1931's baseline are what must run
before the first route (instance probe, connection status, token bound to
its instance, storage backend and write serialization); the baseline is
raised with a note, under the PR's perf-baseline-increase label.

The sign-in component provides the form-field defaults per component, as
master's check (#1928) now requires.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

libs/services/src/lib/server-access-token.ts

@@ -75,3 +75,29 @@ export function clearServerAccessToken(): void {
         // Nothing stored.
     }
 }
+
+/**
+ * Whether `url` goes to the backend: the same origin as the backend URL and
+ * a path inside it. A plain prefix check fails for `BACKEND_URL=/`, where
+ * every URL, other origins included, would carry the token.
+ */
+export function isBackendUrl(
+    url: string,
+    baseUrl: string,
+    pageUrl = globalThis.location?.href ?? 'http://localhost/'
+): boolean {
+    try {
+        const base = new URL(baseUrl, pageUrl);
+        const target = new URL(url, pageUrl);
+        const root = base.pathname.endsWith('/')
+            ? base.pathname
+            : `${base.pathname}/`;
+        return (
+            target.origin === base.origin &&
+            (target.pathname === base.pathname ||
+                target.pathname.startsWith(root))
+        );
+    } catch {
+        return false;
+    }
+}

libs/services/src/lib/server-storage/server-access-token.interceptor.ts

@@ -8,9 +8,14 @@ import {
 import { inject, Injectable } from '@angular/core';
 import { Observable, tap } from 'rxjs';
 import {
+    isBackendUrl,
     isGatewayOutage,
     isServerAccessChallenge,
 } from '../server-access-token';
+
+// Lives with the token helpers so the startup bundle can check URLs
+// without loading the server storage code.
+export { isBackendUrl } from '../server-access-token';
 import { ServerStorageStatusService } from '../server-storage-status.service';
 import { SERVER_STORAGE_CONFIG } from './server-storage.config';
 
@@ -67,29 +72,3 @@ export class ServerAccessTokenInterceptor implements HttpInterceptor {
         );
     }
 }
-
-/**
- * Whether `url` goes to the backend: the same origin as the backend URL and
- * a path inside it. A plain prefix check fails for `BACKEND_URL=/`, where
- * every URL, other origins included, would carry the token.
- */
-export function isBackendUrl(
-    url: string,
-    baseUrl: string,
-    pageUrl = globalThis.location?.href ?? 'http://localhost/'
-): boolean {
-    try {
-        const base = new URL(baseUrl, pageUrl);
-        const target = new URL(url, pageUrl);
-        const root = base.pathname.endsWith('/')
-            ? base.pathname
-            : `${base.pathname}/`;
-        return (
-            target.origin === base.origin &&
-            (target.pathname === base.pathname ||
-                target.pathname.startsWith(root))
-        );
-    } catch {
-        return false;
-    }
-}