max / makenotwork

Describe the four sessionless auth pages, so the caret has somewhere to start `/login`, `/forgot-password`, `/reset-password` and `/auth/2fa` are described screens now, and the first consumer of `Screen::opens_at`. Each carried exactly one `autofocus`, and the caret landing in the one box a reader came here to type into is the whole of what these pages do. Five templates and five Askama structs are gone: the four pages plus `partials/login_error.html`. Not on a quasi mount, deliberately. `Viewer` carries the app state, the runtime and the token and does not carry the session, and all four of these GETs need it: `/auth/2fa` reads a pending-2FA key and re-checks the tracking row, `/reset-password` re-validates a signed HMAC link, `/login` reads two query parameters and `Config::sso`. So the routes keep the extractors they had and what is described is the document. Moving the addresses onto the mount would be a rewrite of four auth guards to change no pixel. The POST handlers answer into the region the description names, which is what `Action::replacing` is documented for. Two things followed from that: - A form's answer replaces the region itself (`hx-swap="outerMorph"`), so a bare alert would replace the element the next attempt has to aim at and a second wrong password would land nowhere. `auth_pages::answered` renders the region with its id, and the four handlers answer with that instead of `LoginErrorTemplate`/`AlertTemplate`. The banner is the description's now, drawn by the renderer that drew the page. - `/auth/verify-2fa` targeted `closest .login-container` with `outerHTML` and answered with a whole rendered page, so a mistyped digit swapped an entire document into a `div`. It answers into `form-feedback` like its siblings. Two things the vocabulary could not say, handled rather than dropped: - The passkey offer is a `RegionKind::Handover`. A `data-action` the classic dispatcher resolves is not something a description should learn to say, so the description says there is a place here and the host pays the markup. `page-login-2.js` states WebAuthn support as `data-supported` rather than taking a class off markup it no longer owns. - `reset_password.html` wrote `minlength="8"`. `Field` has a maximum and no minimum, and adding one means a member on the published `makeover_layout::Field` and a cascade through the whole suite for a browser hint. The rule is the server's and always was, so the field carries a hint in words instead -- said before the reader submits rather than after. Also fixes five clippy findings this pass did not introduce, in `collections`, `creators` and the two git annotation modules: a clippy bump had left the gate red for everyone.