Optional sections: checkpoint tracker, admin/roles, login page

- dashboard.html: each section sits in OPTIONAL:<name> BEGIN/END blocks in
  the style, markup and script, with sample answers so a page with no bot
  shows it working. Core change: setUser records the role on <body>, so CSS
  hides admin-only parts from operators.
- templates/sections.py keeps the chosen sections and deletes the rest,
  markers included; it stops on a broken marker.
- templates/sections.md: what each section needs from the host (events,
  actions, desktop slot snippets, the role re-check, the login hand-off).
- SKILL.md step 5 asks one multi-select question and runs sections.py.
- Page check: checkpoint states, admin visibility by role and assign/remove,
  login theme and hand-off to auth or the stub. Cases skip on a generated
  page without the section; the template must carry all three. The harness
  signs in when the page has a login screen.
- tests/test_sections.py: no sections leave no trace, and that page still
  passes the page check.
- Eval runner: a-empty-sections variant (all three) and per-section checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/page_check/conftest.py

@@ -22,6 +22,7 @@ TEST_FILL = {
     "API_BASE": "",
     "STEPS_JSON": json.dumps(["Initializing", "Login", "Process items", "Completed"]),
     "REPORT_COLUMNS_JSON": json.dumps([{"key": "item", "label": "Item"}, {"key": "status", "label": "Status"}]),
+    "CHECKPOINTS_JSON": json.dumps(["Sign in", "Open the list", "Process items", "Finish up"]),
 }
 FAKE_BRIDGE = """
 window.__calls = [];
@@ -63,6 +64,8 @@ def page(request, browser, page_url):
     pg.on("pageerror", lambda e: errors.append(e))
     pg.goto(page_url)
     assert not errors, f"page script errors: {errors}"
+    if pg.get_by_role("form", name="Sign in").is_visible():  # login page section: the host lets us in
+        push_to(pg, "login_result", {"ok": True})
     if dark:
         push_to(pg, "apply_dark", {"on": True})
     yield pg