panel-redesign: Sign in and Create administrator on the kit

Stage 2, step 1. Written by Sonnet, reviewed by Opus.

  - templates/login.html, setup.html: written from the mockups as the
    content of layout_signed_out - form.sp-form, kicker, h1, Bulma fields
    with icons, the full-width primary button. Actions, field names,
    autocomplete and autofocus are the old ones.
  - view/signin.go: typed Login and Setup (Meta carries a title only, so
    Engine.Render takes the signed-out layout); auth handlers pass them
    instead of maps.
  - login and setup are in kitPages, have fixtures, and are off
    legacy_pages.txt.

States the mockups do not draw:
  - a refused sign-in / setup is the kit's flash (notification is-danger
    is-light) above the fields;
  - login before any administrator exists shows the old sentence in a
    form.sp-form that has no action and no control: the signed-out
    stylesheet sizes and centres its column through "form" alone. A
    workaround, listed for the owner.

Differences from the mockups, for the owner:
  - the kicker is <p><span class="sp-kicker"> (the kit's partial is a
    span; a page may not write the class), the mockup has <p
    class="sp-kicker">: the block sits about 3px lower;
  - login's kicker is the configured host name and is absent when there
    is none; setup's is the mockup's fixed text;
  - the footer is the layout's legal line (full copyright holder name);
  - the user name field has autofocus, so it shows its focus ring.

Evidence
  - docs/assets/panel-redesign/evidence/login.png, setup.png: 1440x900,
    headless Edge, from the real templates served locally with their
    fixtures - NOT from the container (no Docker on this machine).
  - panel/audit.js on login, login with an error, login without an
    administrator, setup, setup with an error, at 1440 and 1280:
    118 texts checked, problems: [] ; no page is taller than 900px.
  - go test -count=1 ./internal/web/...
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/handlers.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/validate"
+	"github.com/mixeme/selfpost/internal/web/view"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -74,11 +75,7 @@ func (m *Module) HandleLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if !exists {
-		m.view.Render(w, http.StatusOK, "login", map[string]any{
-			"Title":     "SelfPost — Sign in",
-			"Active":    "login",
-			"SetupHint": true,
-		})
+		m.view.Render(w, http.StatusOK, "login", view.NewLoginSetupHint(m.cfg.Hostname))
 		return
 	}
 
@@ -94,11 +91,7 @@ func (m *Module) HandleLogin(w http.ResponseWriter, r *http.Request) {
 }
 
 func (m *Module) renderLogin(w http.ResponseWriter, status int, formErr string) {
-	m.view.Render(w, status, "login", map[string]any{
-		"Title":  "SelfPost — Sign in",
-		"Active": "login",
-		"Error":  formErr,
-	})
+	m.view.Render(w, status, "login", view.NewLogin(m.cfg.Hostname, formErr))
 }
 
 func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
@@ -196,12 +189,7 @@ func (m *Module) HandleSetup(w http.ResponseWriter, r *http.Request) {
 }
 
 func (m *Module) renderSetupForm(w http.ResponseWriter, status int, token, formErr string) {
-	m.view.Render(w, status, "setup", map[string]any{
-		"Title":  "SelfPost — Create administrator",
-		"Active": "setup",
-		"Token":  token,
-		"Error":  formErr,
-	})
+	m.view.Render(w, status, "setup", view.NewSetup(token, formErr))
 }
 
 func (m *Module) submitSetup(w http.ResponseWriter, r *http.Request, token string) {