/login and /sign-in send you to /signin, keeping where you were going #6038

Intent: the address people type to sign in works.

Seen: GET /login on production is a 404 page ("Not found · forge"); the sign-in page is /signin, and signed-out pages already send 303 /signin?next=%2Fsettings.

Done:

• [ ] GET /login and GET /sign-in answer 308 to /signin, carrying next only when it is a same-origin path (starts with one /, not //), otherwise dropping it
• [ ] /signup is untouched; nothing else becomes an alias
• [ ] a test: both aliases redirect, next=/settings survives, next=//evil.test and next=https://evil.test do not

Files: the router where /signin is added, one test. Risk: an open redirect through next: reuse the check /signin already applies to next, do not write a second one.

Parked by the crew: the check failed ("every GET page names session and render in Server-Timing, bar the listed debt") and the decider saw no point in another try try 1: src/http/server.ts, src/web/pages/site.ts, test/signin-alias.test.ts (pull #6055 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("a scorecard row per team > the page shows a team row with its pooled figures, to an admin only") and the decider saw no point in another try try 1: src/checks/proof.ts, src/http/server.ts, src/web/pages/site.ts, test/crew-team-scorecard.test.ts (+3 more) try 2: test/forge-looks.test.ts (pull #7702 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("every GET page names session and render in Server-Timing, bar the listed debt") and the decider saw no point in another try try 1: src/http/server.ts, src/web/pages/site.ts, test/signin-alias.test.ts (pull #6055 closed)
2. the check failed ("a scorecard row per team > the page shows a team row with its pooled figures, to an admin only") and the decider saw no point in another try try 1: src/checks/proof.ts, src/http/server.ts, src/web/pages/site.ts, test/crew-team-scorecard.test.ts (+3 more) try 2: test/forge-looks.test.ts (pull #7702 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Replaced by #7721: same outcome, with what done looks like rewritten so it passes the check — the two aliases join the REDIRECTS set in test/server-timing-sweep.test.ts (the cause of try 1), and the files to touch are named so a try does not wander into the scorecard tests (try 2).