Add CSRF tokens to login and choose-username forms

Both forms were missing the hidden csrf_token input,
causing 400 Bad Request on POST.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/auth/login.html

@@ -11,6 +11,7 @@
   {% endif %}
 
   <form method="post" action="{{ url_for('auth.start_login') }}" class="space-y-4">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     <div>
       <label for="email" class="block text-sm font-medium mb-1">Email address</label>
       <input