Rebuild the auth pages around a shared AuthPageLayout card with a
three-tier guidance hierarchy: the form (or provider buttons) on top,
a centered switch sentence below it, and a quiet explore band anchored
to the card foot on public instances.
- add AuthPageLayout (brand row, chip, empty state, link prompt,
explore band gated by instance URL with hideExplore opt-out)
- extract CredentialFields shared by sign-in and sign-up forms
- extract IdentityProviderButtons; fetch the provider list via a
cached TanStack Query hook with an enabled flag
- cover every instance config: SSO-only, password-only, registrations
closed, private instance, nothing enabled, first-run setup, admin
- promote /auth/signup, /auth/admin, /auth/callback to ROUTES and add
appendSearchParams for param-preserving auth links
- move the explore link out of AuthFooter (selectors only now)
- refresh en and zh-Hans auth strings; drop dead keys
