docs(specs): login migration — password-for-existing + nag-to-link-github

[themightychris]

Summary

A directional change to the cutover auth strategy. Today's spec treats GitHub OAuth as the only auth path and gates existing laddr users with a one-shot claim flow at first sign-in. The new design:

• Existing users keep password sign-in indefinitely. Every successful login auto-rehashes the unsalted-SHA1 credential to argon2id so the corpus drifts toward modern hashing without forcing resets.
• New accounts are still GitHub-only — preserves the spam argument that drove the original GitHub-only decision (which was specifically about new-account sign-up, not existing users).
• Linking GitHub becomes a per-user opt-in surfaced via a persistent yellow banner on `/account`. No deadline pressure; users link when ready. The banner is the only nag mechanism — no modals, no email reminders.
• Sunset deferred — no fixed deprecation date.

Verified facts driving the design

Confirmed against `JarvusInnovations/emergence-skeleton/php-classes/User.class.php:33`:

```php
public static $passwordHasher = 'SHA1';
```

And the verifier:

```php
public function verifyPassword($password)
{
return $this->Password && call_user_func(static::$passwordHasher, $password) == $this->Password;
}
```

Unsalted SHA-1, with loose `==` comparison (timing-leaky). The new `password-hash-rotation.md` spec mandates constant-time compare + rehash-on-login so this corpus drifts to argon2id naturally.

Files changed

• `specs/deferred.md` — splits "email/password auth" into "sign-up: GitHub-only" + note that existing users keep password sign-in
• `specs/behaviors/account-migration.md` — rewritten around three sign-in paths; cutover-window deadline removed
• `specs/behaviors/password-hash-rotation.md` (new) — hash-format detection, constant-time SHA-1 compare, rehash-on-login, anti-enumeration timing floor, argon2id params
• `specs/api/auth.md` — adds `POST /api/auth/login`, `POST /api/auth/password-reset/{request,confirm}`, `POST /api/auth/link-github`; `/api/auth/me` grows `hasGitHubLink` + `lastLoginMethod`
• `specs/screens/login.md` — collapsed secondary "Or sign in with your Code for Philly password" disclosure
• `specs/screens/account.md` — Card 1 gains State A (linked) / State B (not linked, shows banner)
• `plans/login-migration-strategy.md` (new) — plan file with the design rationale + impl follow-up

What's NOT in this PR

This is doc-only. Implementation (route handlers, argon2id dep, rehash logic, password-reset routes, link-github route, SPA banner + secondary login form) lives in a follow-up plan after these specs are reviewed.

Test plan

• No tests apply — pure documentation change.
• Plan validation list ticked except the last item ("PR review confirms direction") which is this PR itself.

🤖 Generated with Claude Code