fix: implement Blazor-native login form to properly update authentication state

Problem: JavaScript login form saved tokens to localStorage but didn't notify
CustomAuthenticationStateProvider, causing [Authorize] pages to remain in
'loading' state indefinitely. The provider only reads tokens when:
1. GetAuthenticationStateAsync() is called (page load)
2. NotifyAuthenticationStateChanged() is triggered (UI updates)

But JavaScript login didn't trigger either, leaving the authentication state
stale.

Solution: Convert AdminLoginForm from HTML+JavaScript to pure Blazor component.
Now the login flow is:
1. User enters credentials in Blazor form
2. HttpClient POST to /api/auth/login
3. Save tokens to localStorage
4. Call CustomAuthenticationStateProvider.LoginAsync() directly
5. Blazor detects auth state change and re-evaluates [Authorize] pages
6. Dashboard [Authorize] page renders successfully

Result: Immediate authentication state update, no loading timeout on protected pages.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

legacy/smartadmin/scripts/pages/auth-login.js

@@ -0,0 +1,14 @@
+const switchToTokenButton = document.querySelector('#switchToToken');
+const switchToRegularButton = document.querySelector('#switchToRegular');
+const regularLogin = document.querySelector('#regular-login');
+const tokenLogin = document.querySelector('#token-login');
+
+switchToTokenButton.addEventListener('click', function () {
+    regularLogin.classList.add('d-none');
+    tokenLogin.classList.remove('d-none');
+});
+
+switchToRegularButton.addEventListener('click', function () {
+    tokenLogin.classList.add('d-none');
+    regularLogin.classList.remove('d-none');
+});