Use numeric PIN keypad for launcher auth

api.php

@@ -8,12 +8,21 @@ header('Cache-Control: no-store');
 
 $config = custom_config();
 
+function launcher_is_digit_password(string $password): bool
+{
+    return $password !== '' && ctype_digit($password);
+}
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $data = custom_read_request_data();
     $action = $data['action'] ?? 'login';
 
     if ($action === 'login') {
         $password = (string)($data['password'] ?? '');
+        if (!launcher_is_digit_password($password)) {
+            custom_json(['result' => 'fail', 'message' => 'password_digits_only'], 401);
+        }
+
         if (custom_verify_password($password)) {
             custom_issue_auth_cookie();
             custom_json(['result' => 'ok']);
@@ -31,6 +40,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $current = (string)($data['currentPassword'] ?? '');
         $next = (string)($data['newPassword'] ?? '');
 
+        if (!launcher_is_digit_password($current) || !launcher_is_digit_password($next)) {
+            custom_json(['result' => 'fail', 'message' => 'password_digits_only'], 422);
+        }
+
         if (!custom_verify_password($current)) {
             custom_json(['result' => 'fail', 'message' => 'current_password_invalid'], 401);
         }