Same-origin page for app.pcbdroid.com: POST /login with query parameters
and an empty body (matches Protoboard PcbdroidApiClient). Password is sent as MD5 hex (UTF-8), not plaintext.
Uses Sign in with Google
(ID token). The OAuth Web Client ID must be listed in the server’s
google.clientid (or related) audience list, and this origin must be in that client’s
Authorized JavaScript origins (e.g. https://app.pcbdroid.com).
Request uses os=Android and deviceType=Android like the Flutter Google path.