feat: centralize frontend auth credentials storage

- Changed frontend password storage location from ~/.config/auracast to server directory for better organization
- Renamed password file from frontend_pw.json to credentials.json to match server conventions
- Updated .gitignore to exclude credentials.json from version control
- Removed environment variable AURACAST_STATE_DIR support since storage location is now fixed

.gitignore

@@ -43,3 +43,4 @@ src/auracast/server/stream_settings.json
 src/auracast/server/certs/per_device/
 src/auracast/.env
 src/auracast/server/certs/ca/ca_cert.srl
+src/auracast/server/credentials.json

src/auracast/utils/frontend_auth.py

@@ -25,17 +25,15 @@ def is_pw_disabled() -> bool:
     return str(val).strip().lower() in ("1", "true", "yes", "on")
 
 
-# Storage paths and permissions
+# Storage paths and permissions (store next to multicast_frontend.py)
 
 def state_dir() -> Path:
-    custom = os.getenv("AURACAST_STATE_DIR")
-    if custom:
-        return Path(custom).expanduser()
-    return Path.home() / ".config" / "auracast"
+    # utils/ -> auracast/ -> server/
+    return Path(__file__).resolve().parents[1] / "server"
 
 
 def pw_file_path() -> Path:
-    return state_dir() / "frontend_pw.json"
+    return state_dir() / "credentials.json"
 
 
 def ensure_state_dir() -> None: