Polish every product workflow across desktop and mobile

Reframe each screen around the decisions compute brokers make: sellable capacity, full-cost margin, pipeline movement, contract deadlines, evidence review, staged imports, and controlled agent access. Group the shell by operating domain, strengthen mobile navigation and sheets, add responsive record treatments, and make loading, error, empty, readiness, and retry states explicit.

The visual audit exposed sortable table targets and an unnamed file input only after exercising the rendered app, so this commit also pins those accessibility decisions at their actual interaction boundaries. Manrope is self-hosted as a single Latin variable subset to keep the stronger hierarchy without shipping unused font payloads.

apps/web/src/pages/SignIn.tsx

@@ -16,6 +16,7 @@ import { KeyRound, Mail } from 'lucide-react';
 import { getSupabase, type PublicConfig } from '@/lib/api';
 import { Button, Card, CardContent, Input } from '@/components/ui';
 import { PiggyMark } from '@/components/PiggyMark';
+import { usePageTitle } from '@/lib/title';
 
 type Method = 'password' | 'link';
 
@@ -26,6 +27,7 @@ export function SignIn({
   config: PublicConfig;
   onCreateAccount: () => void;
 }) {
+  usePageTitle('Sign in');
   const [method, setMethod] = useState<Method>('password');
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
@@ -105,6 +107,15 @@ export function SignIn({
               </div>
             ) : (
               <>
+                <div className="mb-5">
+                  <p className="text-xs font-medium uppercase tracking-[0.14em] text-muted">
+                    Private workspace
+                  </p>
+                  <h2 className="mt-1 text-lg font-semibold">Sign in to PIG</h2>
+                  <p className="mt-1 text-sm text-muted">
+                    Authentication stays with the deployment's identity provider. PIG never stores your password.
+                  </p>
+                </div>
                 <div
                   role="tablist"
                   aria-label="Sign-in method"
@@ -138,9 +149,11 @@ export function SignIn({
                 </div>
 
                 <form onSubmit={submit} className="space-y-3">
-                  <label className="block">
+                  <label className="block" htmlFor="sign-in-email">
                     <span className="mb-1 block text-sm font-medium">Email</span>
                     <Input
+                      id="sign-in-email"
+                      name="email"
                       type="email"
                       required
                       value={email}
@@ -154,9 +167,11 @@ export function SignIn({
                   </label>
 
                   {method === 'password' ? (
-                    <label className="block">
+                    <label className="block" htmlFor="sign-in-password">
                       <span className="mb-1 block text-sm font-medium">Password</span>
                       <Input
+                        id="sign-in-password"
+                        name="password"
                         type="password"
                         required
                         value={password}
@@ -192,7 +207,7 @@ export function SignIn({
                   {config.canSelfRegister ? (
                     <div className="border-t border-border pt-3 text-center">
                       <p className="text-sm text-muted">
-                        Have an invite code but no account?
+                        Have a PIG invite code but no account? Registration remains closed on the shared identity provider.
                       </p>
                       <button
                         type="button"
@@ -204,7 +219,7 @@ export function SignIn({
                     </div>
                   ) : config.inviteRequired ? (
                     <p className="pt-1 text-center text-xs text-muted">
-                      PIG is invite-only. An account alone does not grant access.
+                      This workspace is invite-only. Ask an administrator to provision access; this screen never opens self-registration.
                     </p>
                   ) : null}
                 </form>