Login screen #121

Entry point for all users — admins and regular users share the same login screen.

Scope

• Username/email + password form
• Calls POST /api/v1/auth/login/web (cookie flow)
• Error states:
  • Invalid credentials → inline error message
  • Account disabled → inline error message
  • Account locked → inline error + countdown using Retry-After header
  • Must change password → redirect to change-password screen after successful login (handled by app shell guard, see Redirect to password change screen after login when must_change_password #92)

Dependencies

• App shell issue (auth state + routing)