[UX] Add password visibility toggle to login/setup forms

[yongkangc]

Severity: medium
Category: UX / Accessibility

Password fields on /login and /setup have no show/hide toggle. This is standard UX, especially important on mobile.

Fix: Add a toggle button (eye/eye-off icon) next to each password input that switches between type="password" and type="text".

Part of #73