Render login error messages safely

[yortch]

User Story

As a user navigating to the login page,
I want login error messages displayed as plain text,
so that I can understand authentication issues without untrusted URL content executing in my browser.

Background

Login reads the error query parameter and renders it with dangerouslySetInnerHTML. This permits reflected XSS through a crafted login URL.

Acceptance Criteria

• The login page continues to read an error message from the URL query string.
• Error messages display as visible text in the existing error alert.
• HTML-like input, such as <img src=x onerror=alert(1)>, is shown literally and does not create or execute HTML elements.
• dangerouslySetInnerHTML is removed from frontend/src/components/Login.tsx.
• A React Testing Library test verifies the error value is escaped.
• npm run lint --workspace=frontend and npm run build --workspace=frontend complete successfully.

Scope

Included: safe rendering of login error query parameters and focused regression coverage.

Excluded: changes to authentication behavior, backend error contracts, and general HTML sanitization.