fix: login/signup flow working with session-based auth

- Fixed hashPasswordIO to use real PBKDF2 hashing from Sis.Auth
- Added seed route (rseed) for demo data initialization
- Replaced redirect() in update functions with success views
  (redirect uses throwError_ which broke with effectful 2.4)
- Added loginSuccessView and signupSuccessView with dashboard links
- Patched Hyperbole Socket.hs to parse WebSocket form body into Form params
- Patched Hyperbole Wai.hs to include TargetViewId in response metadata
- Fixed View/Page type mismatches (hyper wrapper vs plain view)
- Removed dead pure after redirect calls
- Verified: login submits, session set, success view rendered

test-login.js

@@ -0,0 +1,47 @@
+const { chromium } = require('playwright');
+
+(async () => {
+    const browser = await chromium.launch({ headless: true });
+    const page = await browser.newPage();
+
+    // Collect ALL console messages
+    page.on('console', msg => console.log('CONSOLE:', msg.type(), msg.text()));
+    page.on('pageerror', err => console.log('PAGE ERROR:', err.message));
+
+    // Listen for network responses
+    page.on('response', resp => {
+        if (resp.url().includes('/rlogin') || resp.url().includes('websocket')) {
+            console.log('RESPONSE:', resp.status(), resp.url().substring(0, 50));
+        }
+    });
+
+    await page.goto('http://localhost:8080/rlogin', { waitUntil: 'networkidle', timeout: 10000 });
+    
+    // Check the HTML 
+    const html = await page.content();
+    console.log('Has "Welcome":', html.includes('Welcome'));
+    console.log('Has "lfEmail":', html.includes('lfEmail'));
+    console.log('Has form action:', html.includes('data-onsubmit'));
+    
+    await page.fill('input[name="lfEmail"]', 'alice@demo.com');
+    await page.fill('input[name="lfPassword"]', 'password123');
+    
+    console.log('Clicking submit...');
+    await page.click('button[type="submit"]');
+    
+    // Wait to see what happens
+    await page.waitForTimeout(4000);
+    
+    const newHtml = await page.content();
+    console.log('After submit URL:', page.url());
+    console.log('Has "Invalid":', newHtml.includes('Invalid'));
+    console.log('Has "Logged In":', newHtml.includes('Logged In'));
+    console.log('Has "Redirecting":', newHtml.includes('Redirecting'));
+    console.log('Has "Dashboard":', newHtml.includes('Dashboard'));
+    
+    // Check cookies
+    const cookies = await page.context().cookies();
+    console.log('Cookies:', JSON.stringify(cookies.map(c => c.name + '=' + c.value)));
+
+    await browser.close();
+})().catch(e => { console.error('FAIL:', e.message); process.exit(1); });