Investigate intermittent login form verification failures

User frequently sees the generic expired/unverified form page after /admin redirects to login and they enter credentials. Investigate safe origin/cookie/CSRF/session-lifetime evidence without requesting or logging passwords, raw cookies or form tokens. Current source findings to verify: - Confirmed by credential-free loopback probes: GET /login succeeds on both 127.0.0.1 and localhost, but a malformed POST reaches form decoding (422) only on 127.0.0.1; localhost is rejected as InvalidCsrf (403). The configured development origin is literal 127.0.0.1. User's exact address has been requested; this is a confirmed failure path, not yet a proven explanation of every reported occurrence. - Confirmed with a failing synthetic regression: a valid anonymous session with only five seconds remaining was reused for a newly rendered login form without renewing the server expiry. Its cookie expiry was refreshed independently. - InvalidCsrf currently conflates several checks, making the generic user-facing error hard to diagnose. Acceptance: - Reproduce the relevant failure(s) with synthetic fixtures and/or credential-free loopback probes; keep hypotheses distinct from confirmed causes. - Fix confirmed fresh-form/origin lifecycle issues without accepting cross-site/null origins, relaxing CSRF matching, extending authenticated lifetimes, or changing unrelated organization work. - Add focused regression tests and safe failure diagnostics; never log credential/token/header/body values. - Pass relevant Rust, synthetic HTTP and real-browser checks. Preserve the existing uncommitted organization feature; no commit or production changes. Implemented and verified: - Canonical browser middleware redirects only GET/HEAD requests with noncanonical authorities to the configured trusted origin before form/cookie issuance. It preserves safe path/query composition, never reflects an untrusted authority, and never redirects credential POSTs. Applied consistently to authentication and organization browser routes; exact/null/cross-origin POST checks remain unchanged. - Valid anonymous form reuse takes a row lock and conditionally renews only an unrevoked, unexpired anonymous session to ten minutes from the current load. Cookie/CSRF values remain stable for other tabs. Expired challenges are replaced; authenticated lifetimes are untouched. - Added safe request-correlated form-failure reason codes (origin_check, missing_or_invalid_cookie, token_mismatch, login_session_unavailable, already_authenticated), with tests excluding raw origins/tokens/cookies/form values from output. - Both initially failing regressions pass, plus expiry/replacement/authenticated-lifetime tests and hostile canonical-target/strict-POST tests. Formatting, strict Clippy, ordinary tests, all 58 non-browser Rust tests through the synthetic gate, five tooling tests, asset gates, eight frontend browser cases and four expanded operator/organization cases pass. Real Chrome starts from localhost and successfully signs in after canonical redirection in both themes with/without JS. - Documentation explains renewal, canonical origins, legitimate stale-form failures, and safe diagnostic codes. Existing organization work remains intact and uncommitted; no production changes. Owned test servers were stopped. Limitation: user's exact address/profile was not confirmed. These are two reproduced failure paths that fit the symptoms, not proof of every occurrence. Further reports should be correlated using the safe reason code/request ID; old forms after genuine expiry or cookie/session replacement still fail closed.