Sign-in page redesign and Portal roles Super Admin / Admin / Viewer

Sign-in: brand panel, show / hide password, Caps Lock warning, moving
background, tab icon. Roles: Super Admin manages Admins and Viewers,
Admin manages Viewers only (and can Start / Stop, see Sign-ins), Viewer
sees claims and Runs only. create_tables.sql moves an old table.
71 test files, 1220 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/add_portal_user.py

@@ -1,9 +1,10 @@
 """
-Add a Portal User from this PC — the way the first Admin is made, when
-nobody can sign in to the Portal yet (spec 2026-10-22 Stage 2, EEWA-32).
+Add a Portal User from this PC — the way the first Super Admin is made,
+when nobody can sign in to the Portal yet, and the only way to make any
+Super Admin (spec 2026-10-22 Stage 2, EEWA-32; roles 2026-10-27).
 
     python tools\\add_portal_user.py                 (asks for everything)
-    python tools\\add_portal_user.py asha Admin "Asha R"
+    python tools\\add_portal_user.py asha "Super Admin" "Asha R"
 
 The password is typed hidden and twice; it is never shown, logged or
 passed on the command line. Needs `tools\\sql\\create_tables.sql` run once
@@ -31,7 +32,8 @@ from web.users import Accounts, ROLES, SqlUserStore, UserError
 def main(argv) -> int:
     username = argv[0] if argv else input("Username: ").strip()
     role = argv[1] if len(argv) > 1 else (
-        input(f"Role ({' / '.join(ROLES)}) [Admin]: ").strip() or "Admin")
+        input(f"Role ({' / '.join(ROLES)}) [Super Admin]: ").strip()
+        or "Super Admin")
     name = argv[2] if len(argv) > 2 else input("Name shown on the Portal: ")
     password = getpass.getpass("Password (10+ characters, hidden): ")
     if getpass.getpass("Password again: ") != password: