feat: Worker portal Stage 4 — IDP-aware sign-in template

Description

Port the 2026-05-14 design package's Sign In.html canvas into a real Askama template backed by the Stage-4 IDP loader. Email-first discovery: user enters email → matched IDP chip highlights → "Continue" routes to that IDP. Zero IDPs configured → empty-state pointer at Studio → Identity. Local-accounts toggle exposes email + password fallback.

Acceptance Criteria

  • Template at services/canopy-web/templates/auth/sign_in.html (or similar)
  • Uses Stage 1 primitives (PanelFrame, Overline, etc.) where applicable
  • Email-first discovery: enter email → htmx call to /v1/auth/discover?email= → matching IDP chip animates highlight; "Continue" button activates
  • Multiple-IDP layout: N chips visible with chip_color + chip_icon from idp.toml
  • Zero-IDP state: empty container with editorial copy + link to Studio → Identity (gated to jurisdiction admins only)
  • Local accounts: if localAccounts.enabled = true, "Use email + password" link below IDP chips
  • axe-core WCAG 2.1 AA clean
  • CSP-clean (no inline scripts; Alpine.js + htmx only)
  • Playwright E2E: discovery hit, discovery miss, zero-IDP, local-account fallback
  • CHANGELOG entry under === Changed

Blocked by

  • Stage 4 IDP loader issue merged

Context & References

Labels

type::feature, priority::medium, program::infrastructure, service::web, workflow::needs-spec, compliance::wcag-21-aa