House rules: numbers through one formatter, no made-up server errors, and the rules fail the build

- Every number shown on a page goes through NumbersExtensions: counts,
  percentages, the nerd readouts and the values written into a style.
- A failure the client builds itself (offline, timeout, retries run out, an
  answer it can't read) is a 400 that names its kind; only a server's own 5XX
  passes through.
- Login, sign-up, recovery and password confirmations leave autocomplete to
  the browser, so it can offer the saved login.
- The Daisy components start with empty lists and attributes, and a
  decorative image still renders alt="".
- Arasaka.HouseRules.Analyzers checks all of this in every build, together
  with PrivaPub.ClientModels.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W4YtEJrgxG12Pc39Fai8Bd

Components/Settings/TotpEditor.razor

@@ -65,7 +65,7 @@
 		{
 			<EditForm Model="disable" OnValidSubmit="Disable" class="flex flex-col gap-2" data-totp-disable>
 				<DataAnnotationsValidator />
-				<DInput TValue="string" Type="password" @bind-Value="disable.Password" Immediate="true" autocomplete="current-password"
+				<DInput TValue="string" Type="password" @bind-Value="disable.Password" Immediate="true"
 						placeholder="@Localizer["Current password"]" data-totp-disable-password />
 				@if (disableWithRecoveryCode)
 				{
@@ -133,7 +133,7 @@
 		{
 			<EditForm Model="setupPassword" OnValidSubmit="Setup" class="flex flex-col gap-2" data-totp-setup>
 				<DataAnnotationsValidator />
-				<DInput TValue="string" Type="password" @bind-Value="setupPassword.Password" Immediate="true" autocomplete="current-password"
+				<DInput TValue="string" Type="password" @bind-Value="setupPassword.Password" Immediate="true"
 						placeholder="@Localizer["Current password"]" data-totp-setup-password />
 				<ErrorViewer />
 				<div class="flex flex-wrap justify-end gap-2 pointer-coarse:gap-2">