fix(auth): show error feedback on failed htmx login/registration

Found while double-checking /login after the redirect fix: a wrong
password left the form completely silent. Two stacked causes, both
pre-dating the CSP work:

1. The two HX-Request branches for invalid credentials returned JSON,
   unlike every sibling error branch — there was no HTML partial to
   show at all. They now return a shared invalidCredentialsHTML div
   (the JSON shape is kept for non-htmx API callers).
2. htmx does not swap 4xx/5xx responses by default, so even the HTML
   error partials that DID exist (429 lockout, 500s, registration
   failures like "Email already exists") never landed in the target.
   auth_forms.ts now swaps them itself on htmx:beforeSwap when the
   error response is text/html — JSON errors stay ignored.

Verified live: /login success → /dashboard; wrong password shows
"Invalid email/username or password." and stays on /login; duplicate
email on /register shows "Email already exists". Gates: make test 9
pkgs, vitest 155, Playwright 20.

internal/handlers/auth.go

@@ -365,6 +365,10 @@ func (h *AuthHandler) Register(c *echo.Context) error {
 }
 
 // Login handles POST /api/auth/login
+// invalidCredentialsHTML is the htmx error partial for failed logins;
+// web/src/auth_forms.ts swaps 4xx/5xx HTML responses into the form target.
+const invalidCredentialsHTML = `<div class="text-red-500">Invalid email/username or password.</div>`
+
 func (h *AuthHandler) Login(c *echo.Context) error {
 	login := c.FormValue("login")
 	password := c.FormValue("password")
@@ -421,7 +425,7 @@ func (h *AuthHandler) Login(c *echo.Context) error {
 		}
 
 		if c.Request().Header.Get("HX-Request") == "true" {
-			return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
+			return c.HTML(http.StatusUnauthorized, invalidCredentialsHTML)
 		}
 		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
 	}
@@ -437,7 +441,7 @@ func (h *AuthHandler) Login(c *echo.Context) error {
 		}
 
 		if c.Request().Header.Get("HX-Request") == "true" {
-			return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
+			return c.HTML(http.StatusUnauthorized, invalidCredentialsHTML)
 		}
 		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid credentials"})
 	}