nx_connect_auth_gate.nx

nx_connect_auth_gate.nx -- proves TWO things about CONNECT's real-login rung: PART A (rendering, pure): the serve core renders the signed-out vs signed-in app correctly from the per-request auth slots the daemon stamps -- login/register forms when out, identity + sign-out when in, the nav identity area tracks it, and each auth event maps to the right banner. No crypto here. PART B (the REAL OPAQUE crypto, end-to-end): using the SAME nx_opaque_login seam the daemon uses, in a throwaway realm, register -> login -> whoami round-trips a handle, a WRONG passphrase is REJECTED, and an UNKNOWN handle is REJECTED -- so "signed in" can never be faked. This is the anti-stub proof. license_tier: ORIGINAL expect_exit: 0