fix(auth): improve login accessibility semantics and add auth contract test

Task: AUTH-LOGIN-ACCESSIBILITY-001

web/css/pages/app-login.css

@@ -552,9 +552,16 @@
     margin-bottom: 1rem;
   }
 
+  .login-tenant-fieldset {
+    border: 0;
+    margin: 0 0 1rem;
+    padding: 0;
+  }
+
   .login-tenant-select-label {
     display: block;
     margin-bottom: 0.5rem;
+    font-weight: 600;
   }
 
   .login-tenant-choice-grid {
@@ -601,6 +608,13 @@
     align-self: center;
   }
 
+  .login-tenant-choice-body {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    width: 100%;
+  }
+
   .login-tenant-choice-avatar {
     width: 8rem;
     height: 3rem;
@@ -623,6 +637,13 @@
     color: var(--app-contrast);
   }
 
+  .login-tenant-choice-text {
+    color: var(--app-color);
+    font-weight: 600;
+    overflow-wrap: anywhere;
+    text-align: right;
+  }
+
   .login-alt-separator {
     position: relative;
     margin: 1rem 0;
@@ -649,8 +670,14 @@
     background: var(--app-surface);
   }
 
-  .login-alt-separator + [role="button"] {
+  .login-microsoft-link {
+    display: block;
     width: 100%;
+    text-align: center;
+  }
+
+  .login-secondary-action {
+    margin-top: 1rem;
   }
 
   @media (min-width: 600px) {