I think you have to alter wordpress url rewriting so it doesn't try to handle files in the forum folder. You could also use a directory alias in Apache instead of using a subfolder so you can fully delegate the /forum urls to Flarum.
I'm not sure about the details though, I've never done that. I usually host different apps on different subdomains to avoid issues like those, but both subdomain and subfolder are perfectly valid options.
PS: Also /login is not a valid url in Flarum, unless you have the Flagrow Direct Links extension installed. But you should see Flarum's "method not allowed" error instead of Wordpress 404 if the setup was working.
