The login page's password field had no reveal toggle at all — it
was always plain type="password" with no button, unlike the
register page which already had one. Added the same eye-icon toggle
used on register, verified in a real browser with Playwright: click
toggles password<->text and back, value is preserved throughout.
/app/connect fired 3 authenticated requests concurrently on mount
(link token, accounts, Google status) via raw fetch, bypassing both
the new request queue and any refresh-on-401 handling entirely. Same
nonce-race class of bug as the dashboard, plus no recovery path at
all when a call failed. Converted every call on this page to
apiFetch.
The only path to /register read as marketing copy ("Start your
14-day free trial") rather than an obvious sign-up action. Added a
clearer lead-in and a second, redundant link at the bottom of the
form to match the register page's existing "Sign in" link.
