[pournasserian]

Closes #2447

Refs #2434

What

The first admin screens of F-USR (#2428), with the SEC-07 hardening from the first page.

• Core: IUserSignIn (sign in with email and password, sign out). Every failure is the same sign_in_failed error, so the page cannot tell an unknown email from a wrong password or a disabled account.
• Host: Identity's application cookie and SignInManager behind CookieUserSignIn. Failed attempts commit so Identity's lockout counts them; an unknown email still hashes the password so timing does not reveal accounts. Sign-in and sign-out append user.signed_in and user.signed_out inside a unit of work with the user as initiator, and the cookie is issued only after the event commits. Every Razor component endpoint requires a signed-in user; setup, sign-in and not found opt out with [AllowAnonymous].
• Infrastructure: a claims principal factory that adds the display name claim, so the log shows the name, not the email.
• Admin: static server-rendered /setup, /sign-in and /sign-out on a centred account layout; the main layout shows the signed-in user and a sign-out button that posts. A fresh install has nobody who can sign in, so every route ends at /setup; afterwards /setup leads to /sign-in. Only a local return URL is followed. Strings go through IStringLocalizer; Identity's error codes are the resource keys, with Identity's message as the fallback text.
• Hardening: anti-forgery on every form (the existing middleware, now with forms behind it); a fixed-window rate limit per client address on posts to pages marked [AcceptsCredentials] (setup and sign-in), ten a minute by default, answered with 429, Retry-After and a plain message instead of the not-found page; Content-Security-Policy (default-src 'self', no inline script or style, frame-ancestors 'none', object-src 'none'), X-Content-Type-Options and Referrer-Policy on every response; Data Protection with a fixed application name and keys persisted to DataProtection:KeysDirectory, shared by both host modes.
• Components (refs Admin shell and component set #2434): Input, Card (header, title, description, content) and FormField (label, description and error wired to the control through for, aria-describedby and aria-invalid), from the initial set in ADR-0011, with bUnit tests. Logical utilities only. /ui-spike now also requires sign-in.
• Host tests: BuildWebApplication and BuildMcpHost now run the configure callback before the composition. Before, the settings tests added arrived after the database was registered, so every host test used fluentcms.db in the test directory; the first-run tests need a fresh database each.
• Tailwind target: after a clean build (CI, a fresh clone) the generated stylesheet was not a static web asset, so the admin was served without CSS. The target added it to Content by absolute path, and the SDK only takes Content matching wwwroot/**; incremental builds worked only because the file already existed when the project was evaluated. It is now added by its path relative to the project. The new asset test caught this on CI.

Why

#2440 left sign-in, the pages and the web hardening for after the admin shell. Choices made here:

• Data Protection keys on disk, not in the database. No migration while F-SCH owns the model this round, and the keys stay apart from the database whose secrets they will protect. The directory is part of what an install keeps, like the media folder (OPS-01); CONTRIBUTING says it must persist and be private.
• Password reset moved to its own slice. M1 has no delivery channel (D25: no email before M2), and a development-only sender would ship a reset that does not work in production. That slice chooses between a one-time link an administrator issues from user management and a host command for the owner.
• No encrypt-a-secret API yet. Nothing stores a secret; the first slice that does adds it on this key ring.
• Strict style-src 'self'. Blazor's default reconnect display injects a <style> element, which the policy blocks: the overlay still appears and disappears, unstyled. The shell's reconnect handling in Admin shell and component set #2434 should bring its own markup rather than loosen the policy.

No new NuGet dependency: authentication, rate limiting and Data Protection come from the ASP.NET Core shared framework the host already uses, and [AllowAnonymous] reaches Admin through Microsoft.AspNetCore.Components.

Left for later, outside this issue:

• Behind a reverse proxy the rate limit sees the proxy's address until forwarded headers are configured (OPS).
• HttpContextInitiator reads the request's user; an interactive page that writes through a circuit will need an initiator from the circuit's authentication state.
• Disabling a user does not yet end their open sessions (security stamp), which belongs with user management.

Tests

Integration, through the running host: a fresh install sends /, /ui-spike, /sign-in and /sign-out to /setup, setup signs the administrator in and lands on home, and /setup then leads to sign-in; setup errors appear next to their fields and create nobody; an anonymous request returns to its route after sign-in and three kinds of external return URL land on home; a wrong password, an unknown email and a disabled account fail alike with no cookie; five wrong passwords lock the account; sign-in and sign-out from the layout are audited with the user as initiator; posts without a valid anti-forgery token get 400; the fourth sign-in post over a limit of three gets 429 while the page stays reachable; the CSP and nosniff are on pages, assets, health and 404s, and the sign-in page's stylesheet and scripts load anonymously; a cookie issued before a restart is valid after it. Unit: return URL checks. bUnit: Input, Card and FormField, including an error that appears after the first render.

Checked by hand in the browser: setup, sign-in, sign-out and /ui-spike in RTL with no CSP violations except the reconnect overlay's style described above.

Checklist

• Linked to an issue a maintainer has confirmed
• Targets v2 (or dev for a v1 security fix)
• Tests or docs updated where behaviour changed
• No tool-generated co-author trailers or footers