In theory, you can inject your own scripts via custom HTML templates or even by modifying static/index.html. However, this only really works for things like analytics integration, not for logic that’s supposed to interact with the standalone, pre-compiled React application.
Instead, a better (and possibly more secure) solution would probably be to handle this on the server side and only start up and serve the Prodigy app if the user is already authenticated. My comment in this thread describes a solution to a very similar question. This gives you maximum flexibility over how you want to present the annotator login. And using a custom recipe (e.g. one that wraps the built-in textcat.teach), you can very easily put your own service inbetween Prodigy and the annotator(s), and even manage the annotation tasks that get sent out on a per-user basis. If you search the forum for “multiple annotators”, you’ll find some more examples of this.
There are also some pretty cool solutions contributed by other users – for example a snippet for basic authentication and a script for a bare-bones multi-annotator setup by @andy.