Sign-in, sign-up and reset in one card: a typed rejection union (bad credentials, address taken, rate limited), per-mode autocomplete tokens, a duplicate-submit guard, and input that survives every failure.