{{/* signin — GET /signin (auth.go's signin handler): estilo's sign-in
     form, the check-your-email state that replaces it, the Keymail
     continuation (auth_navigation.go), which needs its meta refresh, or
     the confirm step an emailed link opens (GET /auth/verify,
     auth_navigation.go's confirmSignin): one Sign in button that POSTs
     the token back, because a GET must spend nothing.

     rastrillo/auth's own handlers never render this page themselves
     (magic-links.md: "the sign-in page stays yours"). Begin, Callback and
     Verify report outcomes by redirecting back here with ?sent=1 or
     ?err=…, which auth.go resolves into the data below; the confirm step
     and a refusal call back into it (Config.RenderConfirm, Config.Refused).

     The bar shows the brand only: no account, no Sign in (chrome.go's
     signinPage). It used to be hidden outright, because the rastrillo
     shell could not be emptied, and the front door had no name on it. */}}
{{define "content"}}
{{- if .ContinueURL}}
<meta http-equiv="refresh" content="0;url={{.ContinueURL}}">
{{template "estilo-door-open" .Door}}<p><a rst-btn="primary" href="{{.ContinueURL}}">{{.SubmitLabel}}</a></p>{{template "estilo-door-close"}}
{{- else if .Confirm}}{{template "estilo-door-open" .Door}}
  <h1>{{.Confirm.Heading}}</h1>
  <form rst-form method="post" action="{{.Confirm.Action}}">
    <input type="hidden" name="token" value="{{.Confirm.Token}}">
    <div rst-form-foot><button rst-btn="primary" type="submit" autofocus>{{.Confirm.Submit}}</button></div>
  </form>
{{template "estilo-door-close"}}
{{- else if .Sent}}{{template "estilo-signin-sent" .Sent}}
{{- else}}{{template "estilo-signin" .Form}}{{end}}
{{end}}