feat(auth): welcome/landing page + email-password login UI (5b)

Replace the old Google-only login card with a public landing page (Welcome.tsx):
hero + auth card (email+password Sign in / Create account / Forgot password,
Continue with Google, explicit Try-the-demo) over a feature pitch (6 pain->solution
cards) and demo-account screenshot slots (graceful placeholder until the images are
dropped into frontend/public/welcome/). Auth forms wire to the 5a endpoints; errors
show inline via a new req() quiet flag (no global modal for a wrong password).
Handles ?verify, ?reset (set-new-password form), ?access banners. EN/HU/DE.
Verified end-to-end on a fresh load: render, register->approve->password-login.

frontend/src/i18n/locales/en/welcome.json

@@ -0,0 +1,73 @@
+{
+  "hero": {
+    "title": "Your YouTube subscriptions, the way a feed should work.",
+    "subtitle": "Siftlode pulls every upload from the channels you follow into one clean, filterable feed — no algorithm deciding what you see, and no Shorts or live noise unless you want it.",
+    "trust": "Self-hosted and private. Sign in with email, or continue with Google."
+  },
+  "preview": {
+    "feed": "The feed — filter by channel, language, topic, length and date.",
+    "channels": "Channel manager",
+    "playlists": "Playlists"
+  },
+  "features": {
+    "heading": "Why Siftlode",
+    "readable": {
+      "title": "Your subscriptions, actually readable",
+      "body": "Sort and filter by channel, language, topic, length or date — and hide channels without unsubscribing. You decide what surfaces, not an algorithm."
+    },
+    "neverMiss": {
+      "title": "Never miss an upload",
+      "body": "Every video from every channel you follow lands in one feed. Shorts and live streams are tucked away by default, so it's just the videos you came for."
+    },
+    "playlists": {
+      "title": "Playlists that sync both ways",
+      "body": "Build playlists locally and keep them in sync with YouTube — changes flow in both directions."
+    },
+    "player": {
+      "title": "Watch in-app, pick up where you left off",
+      "body": "An in-app player resumes each video where you stopped — no recommendation rabbit-hole pulling you off course."
+    },
+    "channels": {
+      "title": "A real channel manager",
+      "body": "Prioritise the channels you care about, tag them your way, and filter the feed by your own tags."
+    },
+    "private": {
+      "title": "Self-hosted, private, multilingual",
+      "body": "Run it yourself — your data stays yours. Multi-user, with the interface in English, Hungarian and German."
+    }
+  },
+  "auth": {
+    "signinTitle": "Sign in",
+    "createTitle": "Create your account",
+    "forgotTitle": "Reset your password",
+    "resetTitle": "Set a new password",
+    "email": "Email",
+    "password": "Password",
+    "newPassword": "New password (min {{min}} characters)",
+    "invalidEmail": "Enter a valid email address.",
+    "weakPassword": "Password must be at least {{min}} characters.",
+    "genericError": "Something went wrong. Please try again.",
+    "working": "Please wait…",
+    "signinButton": "Sign in",
+    "createButton": "Create account",
+    "forgotButton": "Send reset link",
+    "resetButton": "Set password",
+    "createLink": "Create an account",
+    "forgotLink": "Forgot password?",
+    "backToSignin": "Back to sign in",
+    "or": "or",
+    "google": "Continue with Google",
+    "tryDemo": "Try the demo",
+    "demoHint": "Enter an email that's been enabled for the demo account.",
+    "demoEmail": "Demo email",
+    "demoEnter": "Enter",
+    "demoDenied": "That email isn't enabled for the demo. Ask the admin to add it.",
+    "registerDone": "Almost there — check your email for a verification link. After you confirm it, an admin approves your account before you can sign in.",
+    "forgotDone": "If that email has an account, we've sent a reset link. Check your inbox.",
+    "resetDone": "Your password has been set — you can sign in now.",
+    "verifyOk": "Email confirmed. Once an admin approves your account, you can sign in.",
+    "verifyInvalid": "That verification link is invalid or has expired.",
+    "accessRequested": "Thanks — we recorded your request. An admin will review it.",
+    "accessDenied": "That account isn't approved for this instance yet — register below or ask the admin for access."
+  }
+}