Fix empty allauth forms, and lay out the 2FA page

The 2FA code input was not invisible -- it was absent, along with the fields of
every other allauth form except login.

Cause: the `fields` element passed `attrs.exclude` straight into a filter. On a
page that never sets it, resolving a filter *argument* raises
VariableDoesNotExist; Django rescues that for the main variable of an expression
but not for a filter argument, and {% if %} then swallows it and reads the
condition as false. So every field was skipped. Login was the one page that
passes `exclude`, which is exactly why it kept working and hid the damage.
`exclude` is now pinned to a real variable first, with tests that render the
login, signup and password-reset forms and assert their inputs exist.

Two dangling buttons fixed while in here: `elements/form.html` dropped the `id`
attribute, so the out-of-band forms allauth generates (webauthn_form,
logout-from-stage) had no id for a button's `form` attribute to point at. "Use a
security key" submitted nothing.

Layout: the code is a daisyUI otp field, Cancel sits beside Sign In as a plain
button, both gain icons, and "Use a security key" becomes an accent button.

The otp boxes yield once more than six characters are typed. allauth accepts a
TOTP code (6) *or* a recovery code (8) in this one field, so hard-boxing it to
six would have locked out every recovery code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/allauth/elements/fields.html

@@ -17,9 +17,17 @@
         <span>{{ error }}</span>
     </div>
 {% endfor %}
+{% comment %}
+    `exclude` lets a page lay a field out itself — the login page puts "remember" on the
+    button row. It is pinned to a real variable first, and that is not cosmetic: passing
+    `attrs.exclude` straight into a filter on a page that never set it raises
+    VariableDoesNotExist, which Django catches for the *main* variable of an expression
+    but not for a filter *argument*. {% if %} then swallows it and reads the condition as
+    false — silently dropping every field on every form that doesn't pass `exclude`.
+{% endcomment %}
+{% with exclude=attrs.exclude|default:"" %}
 {% for field in attrs.form.visible_fields %}
-    {# `exclude` lets a page lay a field out itself — the login page puts "remember" on the button row. #}
-    {% if not field|excluded:attrs.exclude %}
+    {% if not field|excluded:exclude %}
     <div class="form-control my-3 w-full">
         {% if field.field.widget.input_type == "checkbox" %}
             <label class="label cursor-pointer justify-start gap-3" for="{{ field.id_for_label }}">
@@ -55,3 +63,4 @@
     </div>
     {% endif %}
 {% endfor %}
+{% endwith %}