T10.6 - before/after login screenshots at 390px and 1440px

Closes the last CLAUDE.md verification box on T10.6, which requires any task
touching the frontend to be exercised at both widths with screenshots in the PR.

Captured with the repo's own tests/baseline_shots.py rather than by hand; it
already treats login as the one page whose real state is signed out. "Before"
was shot from a detached git worktree at main (a8e28bf) so each half ran against
its own server - the old login page needs the forgot-password endpoints that no
longer exist here. The worktree is removed again; the working checkout was never
switched.

What the diff shows, at both widths:

  the two reset views are gone
  the password field gained a hint saying WHICH password to type
  "Forgot password?" stays, now pointing at Okta

The hint uses the .hint class login.html already had, so no CSS was added and
no literal with it. It wraps to two lines at both widths, sits between the
password field and the button, and nothing overflows or shifts the card.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/waves/wave-10.md

@@ -275,7 +275,7 @@ Keep the role-granting controls exactly as they are. That is criterion 4.
 - [ ] the password field says which password to enter
 - [ ] no dead `<a href="#">` or handler remains for a removed view
 - [ ] granting admin to an existing user still works from the console
-- [ ] exercised at 390px and at 1440px, screenshots in the PR
+- [x] exercised at 390px and at 1440px, screenshots in the PR — `docs/reference/baseline/before-wave10/` and `after-wave10/`, captured Aug 24 with `tests/baseline_shots.py`. "Before" comes from a detached worktree at `main` (`a8e28bf`) so each half was shot against its own server.
 - [ ] no raw hex added to any stylesheet (the token rule)
 
 ---