The /signin and /signup pages speak the home page's language #9821

/signin and /signup no longer put the form in a card. authForm in src/web/pages/site.ts now draws one <h1>, the form with the passkey and password doors shown today, and the link to the other page, all on the page's own background like the home page. The only code change is in authForm: ${card(body)} became ${body}. The CSRF/same-origin field, the throttle, the passkey script and every door, refusal and throttle message are unchanged.

• Test: the new test/auth-language.test.ts loads both pages signed out. It checks for exactly one h1, the form posting to that page, and no card class or card-body inside <main>. Main still wraps the form in card(, so this test would fail there; I didn't actually run it against main.
• Existing tests: the seven sign-in and sign-up suites named in the issue pass without changes (50 tests across 8 files with the new one).
• Other checks: scripts/gate.ts, tsc --noEmit and bun scripts/design-lint.ts are clean. Only those 8 test files were run here, not the whole suite.
• Design note: no new class. docs/design/areas/forms.md gets a note on the new layout.
• Left alone: terminalCard and newRepoForm in the same file still use card(, as the issue asks.
• JavaScript off: the form is plain server-rendered HTML that posts on its own. I didn't load the pages with JavaScript disabled.

Try: open /signin and /signup on the preview while signed out. Each shows one heading and the form on the page background, with no card.

🤖 Generated with Claude Code

Closes #9812

/signin and /signup no longer put the form in a card. authForm in src/web/pages/site.ts now draws one <h1>, the form with the passkey and password doors shown today, and the link to the other page, all on the page's own background like the home page. The only code change is in authForm: ${card(body)} became ${body}. The CSRF/same-origin field, the throttle, the passkey script and every door, refusal and throttle message are unchanged.

• Test: the new test/auth-language.test.ts loads both pages signed out. It checks for exactly one h1, the form posting to that page, and no card class or card-body inside <main>. Main still wraps the form in card(, so this test would fail there; I didn't actually run it against main.
• Existing tests: the seven sign-in and sign-up suites named in the issue pass without changes (50 tests across 8 files with the new one).
• Other checks: scripts/gate.ts, tsc --noEmit and bun scripts/design-lint.ts are clean. Only those 8 test files were run here, not the whole suite.
• Design note: no new class. docs/design/areas/forms.md gets a note on the new layout.
• Left alone: terminalCard and newRepoForm in the same file still use card(, as the issue asks.
• JavaScript off: the form is plain server-rendered HTML that posts on its own. I didn't load the pages with JavaScript disabled.

Try: open /signin and /signup on the preview while signed out. Each shows one heading and the form on the page background, with no card.

🤖 Generated with Claude Code