refactor(phase-2): extract auth CSS to stylesheet, harden session API, fix Firebase v10 error codes

- Move 374-line inline style block from login.php into assets/style.css (Phase 2 section)
- Add auth-page, auth-card, auth-tabs, auth-form, profile-shell and related
  classes to the main stylesheet as the single source of truth for all styles
- Fix Firebase v10 compat SDK error code: auth/invalid-credential now handled
  alongside legacy auth/wrong-password and auth/user-not-found codes
- Harden api/session.php: add Content-Type JSON header, email format validation,
  and a full security documentation comment explaining the token trust model
- Add FOUC comment to partials/head.php clarifying dark-only design intent

partials/head.php

@@ -70,7 +70,9 @@ $description = $description ?? 'Seasonal recipes, tested tips, and approachable
   <!-- Lenis smooth scroll (CDN) -->
   <script src="https://cdn.jsdelivr.net/npm/@studio-freight/lenis@1.0.42/bundled/lenis.min.js"></script>
 
-  <!-- Set theme instantly to avoid flash -->
+  <!-- Set theme instantly before paint to avoid FOUC (flash of unstyled content).
+       FlixCooks is a dark-only design by choice — no light mode is offered.
+       The theme attribute and localStorage flag are set unconditionally here. -->
   <script>
     (function(){
       document.documentElement.setAttribute('data-theme', 'dark');