Login: clone WorkClaw's two-panel /sign-in shell (Clawmates-branded)

Restyled /login into WorkClaw's two-panel auth design: a white form card on
the left, a periwinkle "meet the crew" panel on the right (claw roster strip,
"Your AI crew, all hands on deck", the claws-at-desk art), light-themed via
the marketing palette. The right panel is hidden on mobile.

- Kept /login as the canonical route (workspace redirect, /api/auth/login,
  and the whole E2E sign-in flow depend on it) and kept our email/password
  mechanism — only the chrome changed. Field labels (Email/Password) and the
  "Sign in" button are preserved so p0–p6 keep passing.
- Added /sign-in → /login redirect so WorkClaw's URL resolves.
- New AuthShell wraps both the local form and the Clerk SignIn branch.
- LoginForm restyled to the light card aesthetic (rounded inputs, full-width
  ink button); uses AA-safe coral-strong for the focus ring / error.
- Regenerated the login visual baseline.

typecheck/lint/build green · p0-shell (full sign-in flow) green · p6-a11y
green · login + marketing @visual green · deployed and verified live
(/login 200, /sign-in 307 → /login).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

frontend/src/app/sign-in/page.tsx

@@ -0,0 +1,8 @@
+import { redirect } from "next/navigation";
+
+// WorkClaw signs in at /sign-in; our canonical route is /login (the workspace
+// redirect, the backend /api/auth/login, and the E2E flow all use it). Keep
+// the familiar URL working by redirecting here.
+export default function SignInPage() {
+  redirect("/login");
+}