Steadier sign-in

What changed

• Sign-in was restored after an authentication-domain regression that affected new sessions.
• The sign-in popup now closes on its own, and content-security rules were adjusted so auth handlers load cleanly.