refactor(frontend): LoginPage consumes @fuzefront/auth-ui AuthPanel

[izzywdev]

Summary

• frontend/src/pages/LoginPage.tsx is now a thin adapter around @fuzefront/auth-ui's AuthPanel (variant="compact" — .auth-form already supplies the card chrome, so variant="full"'s CenteredCard would nest a card inside a card).
• All email/password/signup/Google/MFA-notice form markup + state that used to live in LoginPage.tsx now lives once in AuthPanel (packages/auth-ui).
• An AuthTransport wraps the existing authAPI (login → authAPI.login, signup → authAPI.signup, getAuthMethods → authAPI.getAuthMethods, startSocial → authAPI.startSocialLogin). login/signup reproduce the prior inline catch block's error-message taxonomy (timeout / 503 provider-outage / 401 rejected-credentials / network / 500 / fallback) via a mapAuthError helper, so AuthPanel — which just renders Error.message as-is — shows identical wording to before.
• The page-load social-callback exchange (authAPI.handleAuthCallback() on mount, for the OAuth ?code=/?error= redirect back to the app) stays in LoginPage — that's page-load routing, not a panel concern — and renders its own Alert above AuthPanel (AuthPanel has no prop to surface an externally-sourced result).
• Labels are supplied via useLanguage()/t(...) (only the mode-toggle strings were ever translated on this page; the heading/subtitle were always literal English, which is exactly AuthPanel's default copy).
• Wired @fuzefront/auth-ui into the frontend host exactly like @fuzefront/identity-ui: source alias in vite.config.ts/vitest.config.ts, dist/index.d.ts in tsconfig.json (it's TSX and imports @fuzefront/design-system, so type-checking its source under the frontend's own tsc would pull a second @types/react/csstype copy). Added the CI build chain this requires (@fuzefront/security-client → @fuzefront/auth-ui d.ts, before the frontend type-check) plus auth-ui's own type-check + vitest run, since neither existed in ci.yml before this PR (PR feat(auth-ui): reusable AuthPanel (React + vanilla) + alias-publish #458 wired the publish workflow but not ci.yml).

Known gap (not fixed in this PR)

@fuzefront/auth-ui's AuthPanel (v0.1.0) does not yet implement three things the pre-refactor LoginPage had on signup:

• a confirm-password field,
• the password-policy checklist gating submit,
• an inline email-availability check.

These are UI capabilities the reusable component doesn't yet expose. Reintroducing them as one-off LoginPage markup would refork logic AuthPanel is meant to own, so they're dropped from this page rather than duplicated — tracked as a fast-follow against @fuzefront/auth-ui (a background task suggestion has been filed for this). The "still working…" hint shown during a slow submit is also gone for the same reason (no test covered it).

LoginPage.signup-validation.test.tsx asserted exactly those three behaviors and has been removed; LoginPage.auth-panel-adapter.test.tsx was added to cover the new adapter boundary (signup submits through the transport and redirects; a rejected signup shows the mapped friendly error, not the raw axios message; a social-callback mfa_required result shows the page-level notice).

Verified vs. not

• Not run locally: frontend is not a root npm workspace (its own node_modules, scoped @fuzefront:registry requiring a GitHub Packages token) and this Windows host hit an unrelated npm/npx bin-linking issue building @fuzefront/security-client/@fuzefront/auth-ui locally (tsup/openapi-typescript bins not resolving) — consistent with this repo's documented Windows-local-build limitation. Root npm ci (workspaces only) succeeded locally.
• CI is the verification path for: frontend type-check, frontend npm test (including the new/updated LoginPage.*.test.tsx files), auth-ui type-check + npm test, and the frontend vite build. Will report back once gh pr checks is green.
• LoginPage.signup-route.test.tsx, LoginPage.google-signin.test.tsx, and LoginPage.submit-resilience.test.tsx are unchanged and expected to keep passing — mode-detection, the Google/credentials sign-in paths, and the login error taxonomy are all preserved by the adapter.

Test plan

• CI lint-and-test: frontend type-check + npm test green
• CI auth-ui type-check + vitest green
• CI build: frontend vite build green
• gate-ds-conformance / workspace-deps-check green (no hard-coded design values introduced; @fuzefront/auth-ui resolves from source/workspace, not a registry semver)

🤖 Generated with Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.