Password managers (1Password etc.) failed to recognize the login form
because the identifier field used autocomplete="email" instead of
"username". Fix both real auth forms and close accessibility gaps.
- Auth.tsx + InviteLanding.tsx: identifier input autocomplete
"email" -> "username" (keeps type="email", the recommended pattern).
- Add required + aria-required to email/password (and name on sign-up).
- Wrap auth errors in role="alert" aria-live="polite" with an id, and
reference it from inputs via aria-describedby; toggle aria-invalid
when an error is shown.
- InviteLanding: add namespaced stable ids (invite-email/password/name)
+ htmlFor to match Auth.tsx and ensure programmatic labels.
- Real <form method/action> and the password field lifetime are
unchanged, preserving "save password?" heuristics.
- Add ui vitest coverage (Auth.test.tsx + InviteLanding.test.tsx)
asserting autocomplete/id/required and the alert error region.
InviteUxLab.tsx left untouched: it is a static, read-only design
sandbox (readOnly inputs, no form action/submit) not surfaced to
password managers, so the functional fix does not apply there.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
