Sign-in page redesign and Portal roles Super Admin / Admin / Viewer

Sign-in: brand panel, show / hide password, Caps Lock warning, moving
background, tab icon. Roles: Super Admin manages Admins and Viewers,
Admin manages Viewers only (and can Start / Stop, see Sign-ins), Viewer
sees claims and Runs only. create_tables.sql moves an old table.
71 test files, 1220 tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/templates/users.html

@@ -23,8 +23,9 @@
 {% endblock %}
 {% block content %}
 <h1>Portal Users</h1>
-<p class="sub">Admin: everything, and this page. Operator: see everything,
-  Start / Stop a Run. Viewer: see only. Users are disabled, never deleted.</p>
+<p class="sub">Super Admin: everything, adds and changes Admins and Viewers.
+  Admin: everything, adds and changes Viewers. Viewer: sees the claims and
+  Runs, changes nothing. Users are disabled, never deleted.</p>
 {% if error %}<div class="msg bad" role="alert">{{ error }}</div>{% endif %}
 {% if message %}<div class="msg good">{{ message }}</div>{% endif %}
 
@@ -59,11 +60,14 @@
       </td>
       <td>{{ u.created_at | usdate }}<br><span class="note">by {{ u.created_by }}</span></td>
       <td>
+        {% if u.role in roles and u.username != user.username %}
+        {% if roles | length > 1 %}
         <form method="post" action="/admin/users/{{ u.username }}/role">
           <input type="hidden" name="token" value="{{ run_token }}">
           <select name="role">{% for r in roles %}<option{% if r == u.role %} selected{% endif %}>{{ r }}</option>{% endfor %}</select>
           <button type="submit" class="plain">Set role</button>
         </form>
+        {% endif %}
         <form method="post" action="/admin/users/{{ u.username }}/reset" autocomplete="off">
           <input type="hidden" name="token" value="{{ run_token }}">
           <input name="password" type="password" placeholder="New first password" autocomplete="new-password" minlength="10" required>
@@ -74,12 +78,13 @@
           <input type="hidden" name="token" value="{{ run_token }}">
           <button type="submit" class="plain">Enable</button>
         </form>
-        {% elif u.username != user.username %}
+        {% else %}
         <form method="post" action="/admin/users/{{ u.username }}/disable">
           <input type="hidden" name="token" value="{{ run_token }}">
           <button type="submit" class="plain">Disable</button>
         </form>
         {% endif %}
+        {% else %}<span class="note">—</span>{% endif %}
       </td>
     </tr>
     {% endfor %}