Let testers sign in: an opt-in password form on the login page

The login page offered only a magic link, and the devstack's Supabase
cannot send email: POST /auth/v1/otp for an existing user answers
500 "Error sending magic link email". So nobody could sign in through
the page at all; the e2e browser run only got in by calling the Supabase
client directly.

NUXT_PUBLIC_PASSWORD_LOGIN=true now shows a password form beside the
magic-link one. It is off by default and the form says it is testing
only, so a build for real users never shows it unless someone sets the
flag on purpose.

Verified against the static build (nuxt generate, 5 routes, 524 KB): in
real Chrome the SPA loads, the form signs in, the app leaves /login and
the header shows the signed-in user, with no uncaught page errors.

Also: the Nitro build leaves apps/web/dist as a symlink to the output,
and the `dist/` ignore rule matches only directories, so it showed up as
untracked. The rule is now `dist`.

apps/web/nuxt.config.ts

@@ -29,6 +29,12 @@ export default defineNuxtConfig({
       // wrong address. Keep these in step with that default.
       apiBase: process.env.NUXT_PUBLIC_API_BASE || "http://localhost:3000",
       wsBase: process.env.NUXT_PUBLIC_WS_BASE || "ws://localhost:3000",
+      // Shows a password form on the login page. Off unless asked for: the
+      // real sign-in is a magic link, but that needs the Supabase project to
+      // send email, and the devstack's does not (`POST /auth/v1/otp` answers
+      // 500 "Error sending magic link email"), which left no way to sign in
+      // at all. A build meant for real users must not set this.
+      passwordLogin: process.env.NUXT_PUBLIC_PASSWORD_LOGIN === "true",
       // There is deliberately no go2rtcStreamBase here any more. A camera
       // stream lives on a gateway inside a particular farm's network, each
       // farm has its own, and the gateway tells the backend its address when