fix: prevent empty login form submission

Fix isFormComplete derived always returning true for login mode. Now requires email and password to be non-empty before enabling Sign In button. Add early-return guard in handleSubmit to prevent sending empty credentials.

frontend/src/routes/login/+page.svelte

@@ -15,7 +15,7 @@
 	import * as languageCommon from '@zxcvbn-ts/language-common';
 	import * as languageEn from '@zxcvbn-ts/language-en';
 	import { toast } from 'svelte-sonner';
-	import { sanitizeText } from '$lib/utils/toast-safe';
+	import { extractErrorMessage, sanitizeText } from '$lib/utils/toast-safe';
 
 	// set up options so that feedback, dictionary etc. are included
 	const zxcvbn = new ZxcvbnFactory({
@@ -144,6 +144,12 @@
 
 	async function handleSubmit() {
 		if (isLogin) {
+			const email = formData.email.trim().toLowerCase();
+			if (!email || !formData.password) {
+				toast.error('Please enter your email and password.');
+				return;
+			}
+
 			// Login flow with loading toast
 			const loadingToast = toast.loading('Signing in...');
 
@@ -152,7 +158,7 @@
 					method: 'POST',
 					headers: { 'Content-Type': 'application/json' },
 					body: JSON.stringify({
-						email: formData.email.trim().toLowerCase(),
+						email,
 						password: formData.password
 					})
 				});
@@ -179,7 +185,7 @@
 					toast.error('Invalid email or password.', { id: loadingToast });
 				} else {
 					const text = await response.text();
-					toast.error('Error: ' + sanitizeText(text), { id: loadingToast });
+					toast.error('Error: ' + sanitizeText(extractErrorMessage(text)), { id: loadingToast });
 				}
 			} catch (err) {
 				console.error(err);
@@ -213,7 +219,7 @@
 				toggleMode();
 			} else {
 				const text = await response.text();
-				toast.error('Error: ' + sanitizeText(text), { id: loadingToast });
+				toast.error('Error: ' + sanitizeText(extractErrorMessage(text)), { id: loadingToast });
 			}
 		} catch (err) {
 			console.error(err);
@@ -248,8 +254,9 @@
 
 	// form completion check
 	const isFormComplete = $derived(
-		isLogin ||
-			(formData.firstName.trim() &&
+		isLogin
+			? formData.email.trim().length > 0 && formData.password.length > 0
+			: (formData.firstName.trim() &&
 					formData.lastName.trim() &&
 					formData.phone &&
 					formData.dateOfBirth &&