panel-redesign: Sign in and Create administrator on the kit

Stage 2, step 1. Written by Sonnet, reviewed by Opus.

  - templates/login.html, setup.html: written from the mockups as the
    content of layout_signed_out - form.sp-form, kicker, h1, Bulma fields
    with icons, the full-width primary button. Actions, field names,
    autocomplete and autofocus are the old ones.
  - view/signin.go: typed Login and Setup (Meta carries a title only, so
    Engine.Render takes the signed-out layout); auth handlers pass them
    instead of maps.
  - login and setup are in kitPages, have fixtures, and are off
    legacy_pages.txt.

States the mockups do not draw:
  - a refused sign-in / setup is the kit's flash (notification is-danger
    is-light) above the fields;
  - login before any administrator exists shows the old sentence in a
    form.sp-form that has no action and no control: the signed-out
    stylesheet sizes and centres its column through "form" alone. A
    workaround, listed for the owner.

Differences from the mockups, for the owner:
  - the kicker is <p><span class="sp-kicker"> (the kit's partial is a
    span; a page may not write the class), the mockup has <p
    class="sp-kicker">: the block sits about 3px lower;
  - login's kicker is the configured host name and is absent when there
    is none; setup's is the mockup's fixed text;
  - the footer is the layout's legal line (full copyright holder name);
  - the user name field has autofocus, so it shows its focus ring.

Evidence
  - docs/assets/panel-redesign/evidence/login.png, setup.png: 1440x900,
    headless Edge, from the real templates served locally with their
    fixtures - NOT from the container (no Docker on this machine).
  - panel/audit.js on login, login with an error, login without an
    administrator, setup, setup with an error, at 1440 and 1280:
    118 texts checked, problems: [] ; no page is taller than 900px.
  - go test -count=1 ./internal/web/...
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates_test.go

@@ -81,21 +81,26 @@ func TestLayoutShowsTheVersionOnlyWhenSignedIn(t *testing.T) {
 
 	// Signed out (login, setup) the version must not be advertised, but the
 	// Appropriate Legal Notices must still be present.
-	var buf bytes.Buffer
-	if err := engine.Page("login").ExecuteTemplate(&buf, "layout_legacy.html", map[string]any{
-		"Title": "t", "Active": "", "Version": "9.9.9-test",
-		"Copyright": "Copyright © 2026 Mikhail Yenuchenko",
-		"SourceURL": "https://github.com/mixeme/selfpost",
-	}); err != nil {
-		t.Fatalf("execute login: %v", err)
+	// Both signed-out pages go through Engine.Render, which supplies the
+	// engine's version and the legal lines itself.
+	signedOut := map[string]any{
+		"login": NewLogin("mail.example.org", ""),
+		"setup": NewSetup("token", ""),
 	}
-	out := buf.String()
-	if strings.Contains(out, "9.9.9-test") {
-		t.Errorf("the login page shows the version to unauthenticated visitors:\n%s", out)
-	}
-	for _, want := range legalBits {
-		if !strings.Contains(out, want) {
-			t.Errorf("login page is missing legal notice %q", want)
+	for name, data := range signedOut {
+		rec := httptest.NewRecorder()
+		engine.Render(rec, http.StatusOK, name, data)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("render %s: status %d: %s", name, rec.Code, rec.Body.String())
+		}
+		out := rec.Body.String()
+		if strings.Contains(out, "9.9.9-test") {
+			t.Errorf("the %s page shows the version to unauthenticated visitors:\n%s", name, out)
+		}
+		for _, want := range legalBits {
+			if !strings.Contains(out, want) {
+				t.Errorf("%s page is missing legal notice %q", name, want)
+			}
 		}
 	}
 }
@@ -637,14 +642,18 @@ func TestLoginPageOmitsHelpDrawer(t *testing.T) {
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
-	var buf bytes.Buffer
-	if err := engine.Page("login").ExecuteTemplate(&buf, "layout_legacy.html", map[string]any{
-		"Title": "t", "Active": "",
-	}); err != nil {
-		t.Fatalf("execute login: %v", err)
-	}
-	if strings.Contains(buf.String(), "help-drawer") {
-		t.Error("login page should not include the help drawer")
+	for name, data := range map[string]any{
+		"login": NewLogin("", ""),
+		"setup": NewSetup("token", ""),
+	} {
+		rec := httptest.NewRecorder()
+		engine.Render(rec, http.StatusOK, name, data)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("render %s: status %d: %s", name, rec.Code, rec.Body.String())
+		}
+		if strings.Contains(rec.Body.String(), "help-drawer") {
+			t.Errorf("%s page should not include the help drawer", name)
+		}
 	}
 }