Lay out the login card and wire up the passkey button

Sign In and "Sign in with a passkey" (btn-accent) now sit side by side with
"Remember Me" on the same row, and the email/password block is given room above
and below.

The passkey button was dead. It submits a *different* form -- the hidden
`mfa_login` that allauth renders from its `extra_body` block -- and our layout
base never defined that block, so neither the form nor the webauthn script was
ever emitted and clicking the button did nothing. _base.html now has the block,
and there is a test asserting the form and script are on the page.

The `fields` element grows an `exclude`, so a page can lay a field out itself
(here: "remember", moved onto the button row). It splits on commas rather than
testing for a substring -- "password" is a substring of "password2", and a page
excluding one would otherwise silently drop the other.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/_base.html

@@ -121,5 +121,12 @@
 
             applyMode(currentMode());
         </script>
+
+        {% comment %}
+            allauth puts page-level scripts and out-of-form markup here — notably the
+            hidden `mfa_login` form the passkey button submits. Without this block that
+            form is never rendered and "Sign in with a passkey" is a dead button.
+        {% endcomment %}
+        {% block extra_body %}{% endblock extra_body %}
     </body>
 </html>