Sign in

In production this redirects to Cognito's Hosted UI (email/password + Google SSO — TRD §2). Not wired in this scaffold since no Cognito User Pool is deployed yet.