Drop custom auth dialog; rely on browser Basic Auth handling

Remove ImportDialog and all manual credential management. The browser
handles 401 challenges natively for same-origin fetch requests — it
shows its own credential prompt, retries, and caches the result for
the session. No JS-level auth code is needed.

- api.js: remove authHeader() and all credentials parameters
- store.js: remove credentials field
- ImportDialog.js: deleted
- AppShell.js: remove showImport/openImport/onMounted dialog machinery;
  pass importOnLoad through to PaneCP
- PaneCP.js: inline doImport() (was in ImportDialog); auto-triggers on
  mount when importOnLoad is true; shows inline import error on failure
- StatusPoller.js: remove credentials arg from fetchStatus()
- style.css: remove .se-import-dialog and .se-overlay blocks

static/style.css

@@ -247,54 +247,6 @@
     pointer-events: none;
 }
 
-/* Import dialog */
-.se-import-dialog {
-    position: fixed;
-    top: 50%;
-    left: 50%;
-    transform: translate(-50%, -50%);
-    background: #1e1e1e;
-    border: 1px solid #555;
-    padding: 1.5rem;
-    z-index: 1000;
-    min-width: 20rem;
-}
-
-.se-import-dialog h3 {
-    margin: 0 0 1rem 0;
-    font-size: 1rem;
-}
-
-.se-import-dialog label {
-    display: block;
-    font-size: 0.8rem;
-    color: #aaa;
-    margin-bottom: 0.2rem;
-}
-
-.se-import-dialog input {
-    width: 100%;
-    background: #111;
-    border: 1px solid #444;
-    color: #ddd;
-    padding: 0.3rem;
-    box-sizing: border-box;
-    margin-bottom: 0.8rem;
-    font-family: monospace;
-}
-
-.se-import-dialog .se-dialog-buttons {
-    display: flex;
-    gap: 0.5rem;
-    justify-content: flex-end;
-}
-
-.se-overlay {
-    position: fixed;
-    inset: 0;
-    background: rgba(0,0,0,0.6);
-    z-index: 999;
-}
 
 /* Buttons */
 .se-btn {