House rules: numbers through one formatter, no made-up server errors, and the rules fail the build

- Every number shown on a page goes through NumbersExtensions: counts,
  percentages, the nerd readouts and the values written into a style.
- A failure the client builds itself (offline, timeout, retries run out, an
  answer it can't read) is a 400 that names its kind; only a server's own 5XX
  passes through.
- Login, sign-up, recovery and password confirmations leave autocomplete to
  the browser, so it can offer the saved login.
- The Daisy components start with empty lists and attributes, and a
  decorative image still renders alt="".
- Arasaka.HouseRules.Analyzers checks all of this in every build, together
  with PrivaPub.ClientModels.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W4YtEJrgxG12Pc39Fai8Bd

Services/AuthService.cs

@@ -77,7 +77,7 @@ namespace decePubClient.Services
 
 			var jwtUser = await response.DefaultReadFromJsonAsync<JwtUser>(cancellationToken);
 			if (string.IsNullOrEmpty(jwtUser?.Token))
-				return new WebResult().Invalidate(localizer["The server sent an invalid response."], (int)HttpStatusCode.BadGateway);
+				return new WebResult().Invalidate(localizer["The server sent an invalid response."], (int)HttpStatusCode.BadRequest);
 
 			await authStateProvider.SetSession(jwtUser, cancellationToken);
 			return new WebResult { Data = jwtUser };
@@ -262,7 +262,7 @@ namespace decePubClient.Services
 
 			var setup = await response.DefaultReadFromJsonAsync<ViewTotpSetup>(cancellationToken);
 			if (string.IsNullOrEmpty(setup?.Secret))
-				return new WebResult().Invalidate(localizer["The server sent an invalid response."], (int)HttpStatusCode.BadGateway);
+				return new WebResult().Invalidate(localizer["The server sent an invalid response."], (int)HttpStatusCode.BadRequest);
 
 			return new WebResult { Data = setup };
 		}
@@ -282,7 +282,7 @@ namespace decePubClient.Services
 
 			var enabled = await response.DefaultReadFromJsonAsync<ViewTotpEnabled>(cancellationToken);
 			if (string.IsNullOrEmpty(enabled?.Session?.Token))
-				return new WebResult().Invalidate(localizer["The server sent an invalid response."], (int)HttpStatusCode.BadGateway);
+				return new WebResult().Invalidate(localizer["The server sent an invalid response."], (int)HttpStatusCode.BadRequest);
 
 			await ContinueSession(enabled.Session, nameof(TotpEnable), cancellationToken);
 			return new WebResult { Data = enabled.RecoveryCodes };