fix: visuals reference matching overhaul and better workflow

features/verify_screen.feature

@@ -23,14 +23,16 @@ Feature: Verify account screen
       log-in state instead of the global redirect to /login, and a 403 renders the Invalid-or-
       expired state instead of the global "unverified session" redirect
     And Verifying and No-session-retrying both render the same full-card spinner: a centered
-      "i-lucide-loader-2" icon with a spin animation and the text "Verifying your account…",
+      "i-lucide-loader-2" icon with a spin animation, the title "Verifying your account…" and the
+      line "This only takes a moment.", as the design board's AuthCard spinner draws it,
       role="status", replacing AuthShell's whole card body with no title header shown
     And on a 200, VerifyPage shows a ResultPanel with tone "success", icon "i-lucide-shield-check",
       title "Your account is verified", text "Taking you to your dashboard…", and no actions, while
-      concurrently awaiting session.retry() (needed so /home's route guard sees the now-verified
-      session instead of whatever stale state this tab last cached) and an 800 ms timer; once both
-      settle, the app navigates to /home and a toast (color "success", icon "i-lucide-circle-check",
-      title "Your account is verified", description "Welcome to RenewCMS.") is shown
+      a toast (color "success", icon "i-lucide-circle-check", title "Your account is verified",
+      description "Welcome to RenewCMS.") is shown immediately over that panel, as the design board
+      draws it, while concurrently awaiting session.retry() (needed so /home's route guard sees the
+      now-verified session instead of whatever stale state this tab last cached) and an 800 ms
+      timer; once both settle, the app navigates to /home
     And on a 403 (user.ErrInvalidVerificationCode or user.ErrVerificationCodeExpired), VerifyPage
       shows a ResultPanel with tone "error", icon "i-lucide-link-2-off", title "This verification
       link doesn't work", text "It may have expired (links last 2 hours) or already been used.",
@@ -61,8 +63,10 @@ Feature: Verify account screen
       username") and a Password field (password input with a show/hide toggle), and a submit button
       "Log in and verify"; there is no "Forgot password?" hint and no registration-open footer,
       unlike LoginView
-    And the inline form's submit is disabled until both fields are non-empty; on submit it calls
-      POST /v1/auth/login with { username, password }
+    And the inline form's submit button is enabled, as the design board draws it; on submit,
+      LoginView's own validation runs first (Username under 3 characters shows "Use at least 3
+      characters.", an empty Password shows "Enter your password.", and nothing is sent), and a
+      valid form calls POST /v1/auth/login with { username, password }
     And a 200 from that login call transitions to the No-session-retrying spinner and immediately
       retries POST /v1/auth/verify with the same code and the same passthrough options, which then
       follows the 200/403 handling above
@@ -85,10 +89,10 @@ Feature: Verify account screen
     When POST /v1/auth/verify resolves 200
     Then a ResultPanel is shown with tone "success", icon "i-lucide-shield-check", title "Your
       account is verified", text "Taking you to your dashboard…", and no actions
+    And a toast is shown over it with color "success", icon "i-lucide-circle-check", title "Your
+      account is verified", description "Welcome to RenewCMS."
     And session.retry() is awaited
     And after 800 ms and once session.retry() has resolved, the app navigates to /home
-    And a toast is shown with color "success", icon "i-lucide-circle-check", title "Your account is
-      verified", description "Welcome to RenewCMS."
 
   Scenario: Invalid or expired — 403 offers a way to start over
     Given the user is on "/register/validate?c=abc123" in the Verifying state
@@ -142,11 +146,12 @@ Feature: Verify account screen
       toggle, and a submit button "Log in and verify"
     And there is no "Forgot password?" link and no registration-open footer
 
-  Scenario: No session — submit is disabled until both fields are filled
+  Scenario: No session — empty fields are caught on submit, as on Log in
     Given the inline log-in form from "No session" is shown
-    Then the submit button is disabled
-    When the user types "marta" into Username and "limewash2026" into Password
     Then the submit button is enabled
+    When the user submits with both fields empty
+    Then Username shows "Use at least 3 characters." and Password shows "Enter your password."
+    And POST /v1/auth/login is not called
 
   Scenario: No session — successful login retries verification with the same code
     Given the inline log-in form from "No session" is shown on "/register/validate?c=abc123"
@@ -171,7 +176,8 @@ Feature: Verify account screen
     And POST /v1/auth/login resolves 429 with Retry-After 30
     Then an info alert is shown with title "Too many attempts" and description "For your security,
       wait a moment before trying again."
-    And the submit button reads "Try again in 0:30" and is disabled until the countdown ends
+    And the submit button reads "Try again in 0:30" and it and both fields are disabled until the
+      countdown ends, mirroring LoginView
 
   Scenario Outline: No session — server or network error during the inline login
     Given the inline log-in form from "No session" is shown