I'm confused on login challenges. Where are those generated? They don't seem optional.

Login challenge is just a unique ID of specific login request so you can refer to it.

Right but who generates it? I've cloned the login/consent app. When I hit the login page, it shows a 404 from hydra admin. It's trying to look up the login challenge to find session information but I haven't logged in before so none will exist yet.

A login challenge is generated by hydra, right before it redirects to the consent app to complete it.