feat(auth): unify and polish login, register and homepage auth UI

Login and register each carried their own copy of the promo panel and the
error banner, so the two pages drifted apart and every caller had to wire
role="alert" by hand. Extract a shared AuthPromoCard and AuthAlert, use them
in both forms and for the login notices, and link errors to their fields via
aria-invalid / aria-describedby.

Focus now lands on the 2FA code field the moment it appears, the credential
fields lock while a request is in flight, and invalid inputs get a danger
tint. The homepage top bar was a byte-for-byte duplicate of AuthTopBar; it
now renders the shared component, and the compact homepage login uses the
tighter spacing its comment already promised.

src/components/auth/auth-alert.tsx

@@ -0,0 +1,38 @@
+"use client";
+
+import type { ReactNode } from "react";
+
+interface AuthAlertProps {
+	children: ReactNode;
+	/** Tint of the box: red for errors, green for confirmations. */
+	variant?: "error" | "success";
+	/** Extra classes, e.g. spacing (`mb-4`) or entrance animation. */
+	className?: string;
+	/** Optional id so inputs can point at the message via `aria-describedby`. */
+	id?: string;
+}
+
+/**
+ * The single status/error banner for the auth forms. Uses `role="alert"` for
+ * failures (screen readers announce them immediately) and `role="status"` for
+ * confirmations, so the two are wired correctly instead of every caller
+ * repeating the markup and risking an unannounced message.
+ */
+export function AuthAlert({
+	children,
+	variant = "error",
+	className = "",
+	id,
+}: AuthAlertProps) {
+	return (
+		<p
+			id={id}
+			role={variant === "error" ? "alert" : "status"}
+			className={`auth-alert animate-fade-in-up m-0 ${
+				variant === "success" ? "auth-alert--success" : ""
+			} ${className}`}
+		>
+			{children}
+		</p>
+	);
+}

src/components/auth/auth-promo-card.tsx

@@ -0,0 +1,107 @@
+import Image from "next/image";
+import type { ReactNode } from "react";
+import { SurfaceCard } from "@/components/surface-card";
+
+interface AuthPromoCardProps {
+	/** Fully formatted "N users online" label. */
+	onlineLabel: string;
+	title: ReactNode;
+	subtitle: ReactNode;
+}
+
+/**
+ * The single promo panel both `/login` and `/register` show above the form:
+ * Frank, the online badge and a short welcome. Keeping it in one place means
+ * the two auth pages can never drift apart visually again.
+ */
+export function AuthPromoCard({
+	onlineLabel,
+	title,
+	subtitle,
+}: AuthPromoCardProps) {
+	return (
+		<SurfaceCard
+			className="card-glow relative overflow-hidden p-6 text-center"
+			style={{
+				borderColor:
+					"color-mix(in srgb, var(--color-primary) 20%, transparent)",
+			}}
+		>
+			<div
+				className="absolute inset-0"
+				style={{
+					background:
+						"linear-gradient(135deg, color-mix(in srgb, var(--color-primary) 10%, transparent), color-mix(in srgb, var(--color-accent) 10%, transparent))",
+				}}
+			/>
+			<div aria-hidden="true" className="absolute inset-0 overflow-hidden">
+				<div className="brand-halo left-1/2 top-0 h-64 w-[460px] max-w-full -translate-x-1/2 -translate-y-1/2" />
+				<div
+					className="aurora-blob -left-16 top-10 h-56 w-56"
+					style={{
+						background:
+							"color-mix(in srgb, var(--color-primary) 45%, transparent)",
+					}}
+				/>
+				<div
+					className="aurora-blob -right-16 bottom-0 h-56 w-56"
+					style={{
+						background:
+							"color-mix(in srgb, var(--color-accent) 40%, transparent)",
+						animationDelay: "-8s",
+					}}
+				/>
+			</div>
+			<div className="relative">
+				<div className="brand-halo left-1/2 top-8 h-52 w-52 -translate-x-1/2" />
+				<Image
+					src="/assets/images/FrankwithBag.gif"
+					alt="Frank"
+					width={130}
+					height={170}
+					className="relative object-contain mx-auto drop-shadow-xl animate-float"
+					unoptimized
+				/>
+				<div
+					className="inline-flex items-center gap-2 px-3.5 py-1 rounded-full text-xs font-bold uppercase tracking-wider mt-4 mb-3 border"
+					style={{
+						borderColor:
+							"color-mix(in srgb, var(--color-primary) 30%, transparent)",
+						background:
+							"color-mix(in srgb, var(--color-surface) 72%, transparent)",
+						color: "var(--color-primary-readable, var(--color-primary))",
+						boxShadow:
+							"0 8px 20px -12px color-mix(in srgb, var(--color-primary) 70%, transparent)",
+					}}
+				>
+					<span className="relative flex h-2 w-2">
+						<span
+							className="animate-ping absolute inline-flex h-full w-full rounded-full opacity-75"
+							style={{ background: "var(--color-primary)" }}
+						/>
+						<span
+							className="relative inline-flex rounded-full h-2 w-2"
+							style={{ background: "var(--color-primary)" }}
+						/>
+					</span>
+					{onlineLabel}
+				</div>
+				<h1
+					className="text-xl font-black"
+					style={{
+						color: "var(--color-text-readable)",
+						fontFamily: "var(--font-nunito)",
+					}}
+				>
+					{title}
+				</h1>
+				<p
+					className="text-xs mt-1.5 mx-auto max-w-[240px] leading-relaxed"
+					style={{ color: "var(--color-text-muted)" }}
+				>
+					{subtitle}
+				</p>
+			</div>
+		</SurfaceCard>
+	);
+}

src/components/auth/login-form.tsx

@@ -3,8 +3,9 @@
 import { KeyRound, Lock, UserRound } from "lucide-react";
 import { signIn } from "next-auth/react";
 import { useTranslations } from "next-intl";
-import { type FormEvent, useId, useState } from "react";
+import { type FormEvent, useEffect, useId, useRef, useState } from "react";
 import { precheckLogin } from "@/actions/auth-precheck";
+import { AuthAlert } from "@/components/auth/auth-alert";
 import {
 	type CaptchaPublicConfig,
 	CaptchaWidget,
@@ -51,8 +52,17 @@ export function LoginForm({
 	const [unverified, setUnverified] = useState(false);
 	const [pending, setPending] = useState(false);
 	const [locked, setLocked] = useState(false);
+	const codeRef = useRef<HTMLInputElement>(null);
+
+	// The 2FA field only exists after the pre-check asks for a code; move focus
+	// there automatically so the visitor can keep typing without reaching for
+	// the mouse (the lint rule rules out a bare `autoFocus`).
+	useEffect(() => {
+		if (needs2fa) codeRef.current?.focus();
+	}, [needs2fa]);
 
 	const showFooter = variant === "page";
+	const compact = variant === "compact";
 	const lockCredentials =
 		needs2fa || locked ? "opacity-50 pointer-events-none" : "";
 
@@ -115,7 +125,9 @@ export function LoginForm({
 		<>
 			{needs2fa && (
 				<p
-					className="animate-fade-in-up mb-4 rounded-xl border px-3 py-2.5 text-sm font-semibold"
+					className={`animate-fade-in-up rounded-xl border px-3 py-2.5 text-sm font-semibold ${
+						compact ? "mb-3" : "mb-4"
+					}`}
 					style={{
 						color: "var(--color-text-readable)",
 						background:
@@ -131,7 +143,7 @@ export function LoginForm({
 			<form
 				onSubmit={onSubmit}
 				aria-label={t("signIn")}
-				className="relative flex flex-col gap-4"
+				className={`relative flex flex-col ${compact ? "gap-3" : "gap-4"}`}
 			>
 				<div className={`space-y-1.5 ${lockCredentials}`}>
 					<label htmlFor={`${fieldId}-username`} className="auth-label">
@@ -151,8 +163,10 @@ export function LoginForm({
 							onChange={(e) => setUsername(e.target.value)}
 							placeholder={t("usernamePlaceholder")}
 							autoComplete="username"
-							disabled={needs2fa}
+							disabled={needs2fa || pending}
 							required
+							aria-invalid={error ? true : undefined}
+							aria-describedby={error ? `${fieldId}-error` : undefined}
 							className="auth-input has-icon"
 						/>
 					</div>
@@ -176,8 +190,10 @@ export function LoginForm({
 							onChange={(e) => setPassword(e.target.value)}
 							placeholder={t("passwordPlaceholder")}
 							autoComplete="current-password"
-							disabled={needs2fa}
+							disabled={needs2fa || pending}
 							required
+							aria-invalid={error ? true : undefined}
+							aria-describedby={error ? `${fieldId}-error` : undefined}
 							className="auth-input has-icon has-action"
 						/>
 						<PasswordToggle
@@ -201,6 +217,7 @@ export function LoginForm({
 								style={{ color: "var(--color-primary)" }}
 							/>
 							<input
+								ref={codeRef}
 								id={`${fieldId}-2fa`}
 								name="code"
 								type="text"
@@ -209,6 +226,9 @@ export function LoginForm({
 								placeholder={t("codePlaceholder")}
 								inputMode="numeric"
 								autoComplete="one-time-code"
+								disabled={pending}
+								aria-invalid={error ? true : undefined}
+								aria-describedby={error ? `${fieldId}-error` : undefined}
 								className="auth-input has-icon"
 								style={{
 									borderColor:
@@ -221,15 +241,7 @@ export function LoginForm({
 					<CaptchaWidget captcha={captcha} nonce={nonce} />
 				)}
 
-				{error && (
-					<p
-						role="alert"
-						aria-live="polite"
-						className="auth-alert animate-fade-in-up m-0"
-					>
-						{error}
-					</p>
-				)}
+				{error && <AuthAlert id={`${fieldId}-error`}>{error}</AuthAlert>}
 
 				{unverified && (
 					<p
@@ -249,7 +261,9 @@ export function LoginForm({
 				<button
 					type="submit"
 					disabled={pending || locked}
-					className="btn-brand btn-shine w-full cursor-pointer py-3.5 text-sm font-extrabold uppercase tracking-wider disabled:opacity-60"
+					className={`btn-brand btn-shine w-full cursor-pointer text-sm font-extrabold uppercase tracking-wider disabled:opacity-60 ${
+						compact ? "py-3" : "py-3.5"
+					}`}
 				>
 					{pending ? (
 						<span className="inline-flex items-center justify-center gap-2">

src/components/auth/register-form.tsx

@@ -18,6 +18,7 @@ import {
 	type RegisterState,
 	register,
 } from "@/actions/register";
+import { AuthAlert } from "@/components/auth/auth-alert";
 import { PasswordToggle } from "@/components/auth/password-toggle";
 import Link from "@/components/link";
 import { signInWithTransientRetry } from "@/lib/auth/sign-in-retry";
@@ -183,15 +184,7 @@ export function RegisterForm({
 				}}
 				className="flex flex-col gap-6"
 			>
-				{errorMessage && (
-					<p
-						role="alert"
-						aria-live="polite"
-						className="auth-alert animate-fade-in-up m-0"
-					>
-						{errorMessage}
-					</p>
-				)}
+				{errorMessage && <AuthAlert>{errorMessage}</AuthAlert>}
 
 				{referralCode && (
 					<div