login-ui: enable form for 5s, then show verifying spinner before access-restricted notice

[hortison]

Summary

The login page used to render the form fields disabled from the start and surface the "Access Restricted" warning immediately. That communicates the final state but loses any sense of an active eligibility check. This change introduces a three-phase, JS-driven experience:

• 0-5s (enabled): Form fields and Sign In button are usable. User can type a corporate email / password and tab between fields.
• After 5s (or immediately on submit, whichever first) - verifying: Inputs and button disable, button text flips to "Verifying...", and an info box appears with a CSS-only spinner and the copy "Verifying network access - Confirming that your network is approved for this Meshery remote provider...".
• After ~3s of verifying - restricted: Spinner hides, the existing "Access Restricted" warning reveals, fields stay disabled, button returns to "Sign In".

The actual network-gating of this remote provider is enforced at the network layer; the page provides the perception of the check, not the check itself.

Implementation notes

• No external assets - spinner is a pure CSS @keyframes and is suppressed under prefers-reduced-motion.
• Verifying box is role="status" with aria-live="polite"; restricted box is role="alert". Inputs get autocomplete hints and a visible focus ring.
• Inline onsubmit replaced with a delegated submit listener that short-circuits the 5s wait so submission gives immediate feedback rather than waiting out the timer.
• index.html and login.html were byte-identical (and serve the same role - Meshery's InitiateLogin redirects to <provider>/login, which GitHub Pages serves from login.html). They are kept in sync here. If repeated drift is a problem, a follow-up could deduplicate at build time in the Makefile, but that is out of scope for this UX change.

Test plan

Verified locally with make build && python3 -m http.server, driven through Chrome DevTools:

• Initial: username/password enabled, button "Sign In" enabled, both status boxes hidden, typed engineer@intel.com accepted.
• Verifying (post-submit fast path): username/password disabled, button "Verifying..." disabled, info box visible with spinner element present, restricted box hidden.
• Restricted (post 3s): info box hidden, restricted box visible, fields still disabled, button text "Sign In" but disabled.
• make build produces a valid _site/ with both index.html and login.html carrying the new logic (ENABLED_WINDOW_MS = 5000 match in each).
• After deploy, smoke-check https://perf.smp-spec.io/ and /login in a real browser and confirm the three transitions render at full size.

Screenshots of each phase were attached in the chat where this change was developed.