docs(01-02): complete login pages and auth UI plan

- 01-02-SUMMARY.md: branded login page, password toggle, dashboard stub, logout
- STATE.md: advanced to plan 2/3, added three new auth UI decisions
- ROADMAP.md: updated phase 01 progress to 2/3 plans complete
- REQUIREMENTS.md: AUTH-04 marked complete (logout with signed-out confirmation)

.planning/STATE.md

@@ -2,13 +2,13 @@
 gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
-status: unknown
-last_updated: "2026-03-19T19:35:42.689Z"
+status: in_progress
+last_updated: "2026-03-19T19:39:35Z"
 progress:
   total_phases: 1
   completed_phases: 0
   total_plans: 3
-  completed_plans: 1
+  completed_plans: 2
 ---
 
 # Project State
@@ -23,28 +23,28 @@ See: .planning/PROJECT.md (updated 2026-03-19)
 ## Current Position
 
 Phase: 1 of 7 (Foundation)
-Plan: 1 of 4 in current phase
+Plan: 2 of 3 in current phase
 Status: In progress
-Last activity: 2026-03-19 — Plan 01-01 complete: Next.js scaffold, Drizzle schema, Auth.js v5
+Last activity: 2026-03-19 — Plan 01-02 complete: Branded login page, agent dashboard stub, logout mechanism
 
-Progress: [█░░░░░░░░░] 4%
+Progress: [██░░░░░░░░] 8%
 
 ## Performance Metrics
 
 **Velocity:**
-- Total plans completed: 1
-- Average duration: 6 min
+- Total plans completed: 2
+- Average duration: 4 min
 - Total execution time: 0.1 hours
 
 **By Phase:**
 
 | Phase | Plans | Total | Avg/Plan |
 |-------|-------|-------|----------|
-| 01-foundation | 1/4 | 6 min | 6 min |
+| 01-foundation | 2/3 | 8 min | 4 min |
 
 **Recent Trend:**
-- Last 5 plans: 01-01 (6 min)
-- Trend: baseline
+- Last 5 plans: 01-01 (6 min), 01-02 (2 min)
+- Trend: faster
 
 *Updated after each plan completion*
 
@@ -61,6 +61,9 @@ Recent decisions affecting current work:
 - utahrealestate.com forms scraping: AVOID — violates ToS; use manual PDF upload instead
 - [Phase 01-foundation]: Lazy Proxy singleton for db/index.ts prevents neon() crash during Next.js build when DATABASE_URL absent
 - [Phase 01-foundation]: next-auth pinned to exact version 5.0.0-beta.30; middleware.ts at project root not src/; force-dynamic on auth route
+- [Phase 01-foundation 01-02]: PasswordField extracted as co-located client sub-component — keeps login page.tsx as pure server component
+- [Phase 01-foundation 01-02]: loginAction re-throws non-AuthError (NEXT_REDIRECT must bubble) — critical Auth.js v5 server action pattern
+- [Phase 01-foundation 01-02]: Brand colors applied via inline style props — Tailwind JIT may miss one-off hex values
 
 ### Pending Todos
 
@@ -72,9 +75,10 @@ None yet.
 - Phase 6 (Signing Flow) warrants a /gsd:research-phase before planning — JWT one-time enforcement + ESIGN/UETA audit + mobile touch has edge cases
 - DNS (SPF/DKIM/DMARC) for teressacopelandhomes.com must be configured before any signing link reaches a real client (Phase 6 acceptance criterion)
 - Exact WFRMLS required IDX disclaimer text must be obtained directly from WFRMLS before listings feature ships (Phase 2)
+- Neon + Vercel provisioning required before runtime auth flow can be tested end-to-end
 
 ## Session Continuity
 
 Last session: 2026-03-19
-Stopped at: Completed 01-01-PLAN.md — Next.js scaffold, Drizzle schema, Auth.js v5, route protection
+Stopped at: Completed 01-02-PLAN.md — Branded login UI, agent portal layout, dashboard stub, logout mechanism
 Resume file: None