Sign-in page redesign and Portal roles Super Admin / Admin / Viewer

Sign-in: brand panel, show / hide password, Caps Lock warning, moving
background, tab icon. Roles: Super Admin manages Admins and Viewers,
Admin manages Viewers only (and can Start / Stop, see Sign-ins), Viewer
sees claims and Runs only. create_tables.sql moves an old table.
71 test files, 1220 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/sql/create_tables.sql

@@ -60,7 +60,7 @@ BEGIN
     CREATE TABLE dbo.CV_PortalUser (
         username       NVARCHAR(50)   NOT NULL PRIMARY KEY,  -- lower case
         display_name   NVARCHAR(100)  NOT NULL,
-        role           NVARCHAR(20)   NOT NULL,  -- Admin / Operator / Viewer
+        role           NVARCHAR(20)   NOT NULL,  -- Super Admin / Admin / Viewer
         pw_hash        CHAR(64)       NOT NULL,  -- hex
         pw_salt        CHAR(32)       NOT NULL,  -- hex
         pw_iterations  INT            NOT NULL,
@@ -72,10 +72,24 @@ BEGIN
         created_by     NVARCHAR(50)   NOT NULL,
         changed_at     DATETIME2      NOT NULL,
         CONSTRAINT CK_CV_PortalUser_role
-            CHECK (role IN ('Admin', 'Operator', 'Viewer'))
+            CHECK (role IN ('Super Admin', 'Admin', 'Viewer'))
     );
 END
 GO
+-- Roles from 2026-10-27: Super Admin / Admin / Viewer, no Operator. A table
+-- made before then: its Admins become Super Admins and its Operators
+-- Admins, in that order. Runs until there is a Super Admin; safe to run
+-- again. (Not read from sys.check_constraints: the bot's login may not see
+-- a constraint's definition.)
+IF NOT EXISTS (SELECT 1 FROM dbo.CV_PortalUser WHERE role = 'Super Admin')
+BEGIN
+    ALTER TABLE dbo.CV_PortalUser DROP CONSTRAINT CK_CV_PortalUser_role;
+    UPDATE dbo.CV_PortalUser SET role = 'Super Admin' WHERE role = 'Admin';
+    UPDATE dbo.CV_PortalUser SET role = 'Admin' WHERE role = 'Operator';
+    ALTER TABLE dbo.CV_PortalUser ADD CONSTRAINT CK_CV_PortalUser_role
+        CHECK (role IN ('Super Admin', 'Admin', 'Viewer'));
+END
+GO
 IF OBJECT_ID('dbo.CV_PortalSignIn', 'U') IS NULL
 BEGIN
     CREATE TABLE dbo.CV_PortalSignIn (
@@ -84,7 +98,7 @@ BEGIN
         username  NVARCHAR(50)  NOT NULL,  -- as typed, for a wrong one
         event     NVARCHAR(30)  NOT NULL,  -- sign_in, sign_out, wrong_password,
                                            -- locked, timeout, user_created, ...
-        by_user   NVARCHAR(50)  NULL       -- the Admin, for an Admin change
+        by_user   NVARCHAR(50)  NULL       -- the Super Admin / Admin who changed it
     );
     CREATE INDEX IX_CV_PortalSignIn_at ON dbo.CV_PortalSignIn (at);
 END