Fan sign-in

Password login issues a fan-scoped HttpOnly session cookie via the API. Public registration is not available — accounts are provisioned internally for development and beta. Configure NEXT_PUBLIC_API_ORIGIN to match your backend and reverse-proxy setup.