fix: visuals reference matching overhaul and better workflow

features/login_screen.qa.md

@@ -28,8 +28,9 @@ route starts at the path each case needs.
    `POST /v1/auth/login` resolving 429 with a `Retry-After: 42` header; submit; assert an info alert
    with title "Too many attempts" and description "For your security, wait a moment before trying
    again."; assert Username still reads "marta" and Password still reads "limewash"; assert the
-   submit button reads "Try again in 0:42" and is disabled; advance fake timers by 42 seconds;
-   assert the button re-enables and reads "Log in".
+   submit button reads "Try again in 0:42" and is disabled; assert both fields are disabled;
+   advance fake timers by 42 seconds; assert the button re-enables and reads "Log in" and both fields
+   are editable again.
 7. **Session expired state** — mount at
    "/login?redirect=/article/12/edit&reason=expired"; assert an info alert with title "Your session
    expired" and description "Log in again to pick up where you left off. Unsaved changes are kept on
@@ -71,12 +72,12 @@ Reference: `docs/design/source/RenewCMS Screens Auth.dc.html`, group "Log in".
       and mobile, light and dark.
 - [ ] Wrong credentials state: error alert (circle-x icon, `role="alert"`) above the heading,
       cleared/focused Password field, desktop and mobile, light and dark.
-- [ ] Too many attempts state: info alert (timer icon), disabled button with the live "Try again in
-      m:ss" countdown text, desktop and mobile, light and dark.
-- [ ] Session expired state: info alert (clock icon), focused Password field, desktop and mobile,
-      light and dark.
-- [ ] Password changed state: success alert (circle-check icon, dismissible close button per
-      components.md), desktop and mobile, light and dark.
+- [ ] Too many attempts state: info alert (timer icon), disabled fields and a disabled button with
+      the live "Try again in m:ss" countdown text, desktop and mobile, light and dark.
+- [ ] Session expired state: info alert (clock icon, no close button), focused Password field,
+      desktop and mobile, light and dark.
+- [ ] Password changed state: success alert (circle-check icon, no close button, as the board draws
+      it), desktop and mobile, light and dark.
 - [ ] Server or network error state: error alert (circle-x icon, no close button), fields retain
       their values, desktop and mobile, light and dark.
 - [ ] Keyboard/focus: Tab order is Username → Password → show/hide toggle → "Forgot password?" →