[verified] Security hardening + UX/UI polish

Security (requesting-code-review pipeline + independent reviewer):
- Fix path traversal on file upload (basename sanitize + resolve-containment)
- Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group),
  hide other users' personal groups in listings
- Remove XSS via v-html in Chat task (text interpolation)
- Add test_security.py (traversal + cross-user denial) — all pass

UX/UI (ui-ux-pro-max + frontend-dev-verification):
- Global: focus rings, 44px touch targets, hover/press transitions, input focus glow,
  prefers-reduced-motion, skeleton loaders, empty states, back links, spinner
- Login: password toggle, autocomplete, spinner, disabled-when-empty
- Cards lift on hover; dashboard skeleton + empty state; analyze button spinner

All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.

frontend/src/views/Login.vue

@@ -1,14 +1,21 @@
 <template>
   <div class="login-wrap">
     <div class="card login-card">
-      <h1>{{ i18n.t('app') }}</h1>
+      <h1>🎯 {{ i18n.t('app') }}</h1>
+      <p class="muted" style="margin-top:-8px">Sales training simulator</p>
       <label>{{ i18n.t('email') }}</label>
-      <input v-model="email" type="email" @keyup.enter="submit" />
+      <input v-model="email" type="email" autocomplete="username" @keyup.enter="submit" />
       <label>{{ i18n.t('password') }}</label>
-      <input v-model="password" type="password" @keyup.enter="submit" />
-      <div class="error" v-if="error">{{ error }}</div>
-      <button class="primary" style="width:100%;margin-top:16px" :disabled="loading" @click="submit">
-        {{ loading ? '...' : i18n.t('login') }}
+      <div class="pw-wrap">
+        <input v-model="password" :type="showPw ? 'text' : 'password'" autocomplete="current-password" @keyup.enter="submit" />
+        <button type="button" class="pw-toggle" @click="showPw = !showPw" :aria-label="showPw ? 'Hide password' : 'Show password'">
+          {{ showPw ? '🙈' : '👁' }}
+        </button>
+      </div>
+      <div class="error" role="alert" v-if="error">{{ error }}</div>
+      <button class="primary" style="width:100%;margin-top:16px" :disabled="loading || !email || !password" @click="submit">
+        <span v-if="loading" class="spinner"></span>
+        <span v-else>{{ i18n.t('login') }}</span>
       </button>
     </div>
   </div>
@@ -24,6 +31,7 @@ const route = useRoute()
 const router = useRouter()
 const email = ref('')
 const password = ref('')
+const showPw = ref(false)
 const error = ref('')
 const loading = ref(false)
 
@@ -45,4 +53,9 @@ async function submit() {
 .login-wrap { display: flex; justify-content: center; padding-top: 10vh; }
 .login-card { width: 360px; }
 h1 { margin-top: 0; }
+.pw-wrap { position: relative; }
+.pw-toggle {
+  position: absolute; right: 4px; top: 50%; transform: translateY(-50%);
+  background: transparent; border: none; padding: 6px; min-height: 36px; cursor: pointer;
+}
 </style>