feat(19-04): add LoginError, fetchAuthMode/login/logout + auth fetchers, BrandSlot, brand-seam tokens

- Add LoginError class (4 codes: invalid/rate-limit/locked/server) mirroring SessionExpiredError shape
- Add hasLocalCredential to MeUser interface
- Add fetchAuthMode, fetchLocalLogin, fetchLocalLogout (pre-auth endpoints)
- Add fetchChangePassword, fetchCreateMember, fetchAdminResetPassword, fetchLinkOidc
- Create BrandSlot component with Phase-17-ready placeholder (48px circle, FS initials, h1, tagline)
- Add --brand-logo-* CSS custom properties to tokens.css (Phase 17 seam)

apps/pwa/src/styles/tokens.css

@@ -88,6 +88,18 @@
   --text-display-weight: 600;
   --text-display-line-height: 1.2;
 
+  /* ─────────────────────────────────────────────────────────────────────────
+   * BRAND SLOT — Phase 17 seam tokens
+   * Phase 19 sets placeholder defaults; Phase 17 overrides these values only —
+   * never the BrandSlot component structure (see 19-UI-SPEC.md §Brand Slot).
+   * ───────────────────────────────────────────────────────────────────────── */
+
+  --brand-logo-bg: var(--color-member-0);       /* placeholder circle background */
+  --brand-logo-text: #ffffff;                   /* placeholder initials color */
+  --brand-logo-size: 48px;                      /* reserved slot height; keep 1:1 aspect */
+  --brand-logo-border-radius: 50%;              /* circle for initials; Phase 17 may change */
+  --brand-app-name: 'FamilySync';              /* drives doc only — not used as CSS content */
+
   /* ─────────────────────────────────────────────────────────────────────────
    * BREAKPOINTS (reference; use in @media queries)
    * ───────────────────────────────────────────────────────────────────────── */