Sign-in page redesign and Portal roles Super Admin / Admin / Viewer

Sign-in: brand panel, show / hide password, Caps Lock warning, moving
background, tab icon. Roles: Super Admin manages Admins and Viewers,
Admin manages Viewers only (and can Start / Stop, see Sign-ins), Viewer
sees claims and Runs only. create_tables.sql moves an old table.
71 test files, 1220 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

GLOSSARY.md

@@ -83,9 +83,12 @@ minutes idle.
 _Avoid_: login, logon
 
 **Role**:
-What a Portal User may do. **Admin**: everything, including managing Portal
-Users. **Operator**: see everything and start / stop a Run. **Viewer**: see
-only.
+What a Portal User may do. **Super Admin**: everything; adds and changes
+Admins and Viewers; nobody changes a Super Admin from the Portal. **Admin**:
+everything, including start / stop a Run and the Sign-in history; adds and
+changes Viewers only. **Viewer**: sees the claims and Runs, changes nothing,
+no Portal Users or Sign-in history.
+_Avoid_: Operator (the old role, folded into Admin on 2026-10-27)
 
 **Started By**:
 The Portal User who started a Run from the Portal, or the Windows user for a