Portal sign-in with the Ecare office login

Ecare staff sign in with their office username and password, checked by
the Ecare sign-in service from the backend (AUTH_TOKEN_API_URL); a good
Ecare login still needs a Portal User. Service down = "try again
shortly", never a wrong password. /api/auth/login, me, logout; sign-in
tries limited per address. Users page: Ecare office login or Portal
password per user. Context.md: 27/10 runs, the login retry bug.
71 test files, 1239 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/templates/users.html

@@ -1,7 +1,7 @@
 {% extends "base.html" %}
 {% block title %}Portal Users{% endblock %}
 {% block style %}
-  form.add { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)) auto;
+  form.add { display: grid; grid-template-columns: repeat(5, minmax(0, 1fr)) auto;
              gap: 10px; align-items: end; }
   form.add label { font-weight: 600; font-size: 13px; }
   form.add input, form.add select { display: block; width: 100%; margin-top: 4px; }
@@ -38,10 +38,16 @@
     <label>Role
       <select name="role">{% for r in roles %}<option{% if r == "Viewer" %} selected{% endif %}>{{ r }}</option>{% endfor %}</select>
     </label>
-    <label>First password <input name="password" type="password" autocomplete="new-password" minlength="10" required></label>
+    <label>Sign-in
+      <select name="signin"><option value="ecare" selected>Ecare office login</option><option value="portal">Portal password</option></select>
+    </label>
+    <label>First password <input name="password" type="password" autocomplete="new-password" placeholder="Portal password only"></label>
     <button type="submit">Add</button>
   </form>
-  <p class="note">They change the first password at their first Sign-in.</p>
+  <p class="note">Ecare office login: their own Ecare username and password,
+    nothing to hand over — use their Ecare username here. Portal password
+    (clients, a backup): give a first password; they change it at their
+    first Sign-in.</p>
 </div>
 
 <div class="card">
@@ -55,6 +61,7 @@
       <td>
         {% if u.disabled %}<span class="tag off">Disabled</span>
         {% else %}<span class="tag on">Active</span>{% endif %}
+        <span class="tag">{% if u.ecare %}Ecare login{% else %}Portal password{% endif %}</span>
         {% if u.must_change %}<span class="tag change">Must change password</span>{% endif %}
         {% if u.locked_until %}<span class="tag lock">Locked until {{ u.locked_until | usdate }}</span>{% endif %}
       </td>
@@ -68,11 +75,13 @@
           <button type="submit" class="plain">Set role</button>
         </form>
         {% endif %}
+        {% if not u.ecare %}
         <form method="post" action="/admin/users/{{ u.username }}/reset" autocomplete="off">
           <input type="hidden" name="token" value="{{ run_token }}">
           <input name="password" type="password" placeholder="New first password" autocomplete="new-password" minlength="10" required>
           <button type="submit" class="plain">Reset</button>
         </form>
+        {% endif %}
         {% if u.disabled %}
         <form method="post" action="/admin/users/{{ u.username }}/enable">
           <input type="hidden" name="token" value="{{ run_token }}">