Stabilize authentication modal behavior and improve auth flow consistency

[lucifers-0666]

Description

Cleaned up and stabilized the authentication modal system to remove conflicting logic and improve consistency across login/signup flows.

Changes Made

index.html

• Retained exactly one #auth-modal element — removed all duplicate markup
• Removed all inline style="display:..." toggles from the auth modal element
• Modal is now visible by default (no hidden attribute at load time); JS adds .auth-modal-hidden immediately on confirmed session, preventing flicker
• Moved all auth JS into a single clean <script> block; removed leftover logic scattered across multiple inline scripts
• Removed duplicate <button id="add-btn"> — only one now exists in the panel
• Settings modal retains style.display (intentional — it is not auth, unrelated to this PR)

css/index.css

• Removed duplicate :root block and all duplicated rule sets — the file previously contained the entire stylesheet twice, causing constant cascade conflicts
• Added body.auth-open { overflow: hidden; } for scroll lock
• Added .app.auth-blurred { filter: blur(2px); pointer-events: none; user-select: none; } for dashboard visual recession
• Added .app { transition: filter 0.2s ease; } for smooth blur in/out
• Added --auth-accent and --auth-accent-focus-ring CSS variables for the auth modal's indigo accent, isolated from the main palette
• Added complete .auth-modal-overlay, .auth-modal-hidden, .auth-modal-card styles — single source of truth, no conflicts
• Added @keyframes auth-modal-in for entry animation
• Added :root[data-theme="light"] and :root[data-theme="dark"] overrides to support the settings toggle correctly
• Added .toggle-switch / .toggle-slider styles for the settings dark-mode toggle

js/app.js

• No auth logic existed in app.js — correctly left untouched
• The module handles only dashboard/task/calendar logic; auth lives exclusively in the inline <script> block in index.html

Visibility Strategy

One strategy only — class-based:

// show
authModal.classList.remove('auth-modal-hidden');
document.body.classList.add('auth-open');
appShell.classList.add('auth-blurred');

// hide
authModal.classList.add('auth-modal-hidden');
document.body.classList.remove('auth-open');
appShell.classList.remove('auth-blurred');

No style.display mixed in. No hidden attribute. No opacity hacks.

Testing Checklist

• Only one auth modal exists in the DOM
• No duplicate auth logic remains
• Modal visibility works consistently (class-based only)
• Background cannot be interacted with (pointer-events: none)
• Body scroll locks properly (overflow: hidden)
• Login works (calls /api/auth/login, stores session)
• Signup works (toggle switches endpoint + UI copy)
• Logout restores auth modal (showAuthModal() on click)
• Refresh keeps proper auth state (localStorage check on load)
• No console errors from duplicate IDs or missing elements
• Dashboard remains unchanged after login
• Dark/light mode toggle works via settings

Fixes #450