🐛 Fix first login form submission

[baealex]

🎯 Goal

• Make the password login form submit on the first click.
• Prevent duplicate submissions while the session-generation check is pending.

🛠️ Core Changes

• Capture the login form before the asynchronous submit handler runs.
• Prevent every intercepted submit before checking the in-flight submission guard.
• Mark the submission as active before awaiting the session-generation check.
• Add a DOM regression test that executes the real inline login script and verifies one-click native submission.

🧠 Key Decisions

• Kept the stale-login-page generation check and CSRF flow unchanged.
• Used the native form submit method after the asynchronous guard to avoid recursively firing the submit listener.
• Placed the regression test in the server test directory so the existing CI glob executes it.
• Release impact: release: patch.

🧪 Verification Guide

How to verify

1. Run pnpm check:encoding.
2. Run pnpm lint.
3. Run pnpm test:ci.
4. Run pnpm type-check.
5. Run pnpm build.
6. Open the development login page, enter a password, and click Sign in once.

Expected result

• All standard checks pass.
• Server CI reports 76 passing tests.
• A single click sends one POST request to /login.
• Repeated clicks during the generation check do not bypass or duplicate submission.

✅ Checklist

• Lint completed
• Type-check completed
• Tests completed
• Build completed
• Browser flow verified
• Documentation updated (not needed; expected login behavior is restored)