[devSejung]

What Problem This Solves

PlatformClaw needs an employee-facing login entry point before users can enter their assigned agent workspace. The existing upstream Control UI does not provide the downstream employee authentication and bootstrap surface.

Why This Change Was Made

Adds a small PlatformClaw-owned login shell and static asset boundary while keeping the upstream Control UI application unchanged. The page uses the approved employee session APIs, safe return routes, a legacy-inspired two-column layout, and the PlatformClaw employee mascot. This is the first UI baseline; detailed copy and visual tuning remain intentionally follow-up work.

AI-assisted implementation; the author reviewed and understands the changes.

User Impact

Employees get a responsive /platformclaw/login page that checks an existing opaque session, signs in with their enterprise account, and enters only approved PlatformClaw application routes. Gateway credentials and agent selection remain server-side.

Evidence

• Windows visual check at desktop width against the running local login route.
• 14 focused UI tests passed: login controller, web contract, and exact Vite login route.
• Login-only Vite production build passed and emitted the HTML, hashed CSS/JS, and hashed employee mascot asset.
• oxfmt --check and git diff --check passed for the changed UI files.
• Full Linux Docker validation is intentionally deferred until the first UI fine-tuning pass, per the agreed workflow.

Stacked on #10 (feature/web-ingress-runtime); change the base to main after #10 merges.