Add phase 6 PAN login invitation and client identity

app/ui/app.py

@@ -35,6 +35,7 @@ from app.modules.peer_review_export.ui import router as peer_review_export_route
 from app.modules.bank_statement_analyzer.ui import router as bank_statement_analyzer_router
 from app.modules.registrations.ui import router as registrations_ui_router
 from app.modules.credential_vault.ui import router as credential_vault_ui_router
+from app.modules.client_identity.ui import router as client_identity_ui_router
 
 
 def mount_ui(app: FastAPI) -> None:
@@ -68,6 +69,7 @@ def mount_ui(app: FastAPI) -> None:
     app.include_router(clients_ui_router)
     app.include_router(registrations_ui_router)
     app.include_router(credential_vault_ui_router)
+    app.include_router(client_identity_ui_router)
     app.include_router(employees_ui_router)
     app.include_router(manager_dashboard_router)
     app.include_router(managers_ui_router)

app/ui/routes/auth.py

@@ -19,6 +19,7 @@ from app.core.templating import templates
 from app.core.settings import get_settings
 from app.modules.core.iam.invite_service import accept_invite, reset_password_with_token
 from app.modules.core.iam.models import LoginAttempt, User
+from app.modules.client_identity.service import mark_identity_activated, resolve_login_user
 from app.modules.core.rbac.models import Permission, Role, RolePermission, UserRole
 from app.modules.core.tenancy.models import Branch, FinancialYear, Tenant
 from app.modules.core.tenancy.settings_models import BranchSettings
@@ -446,9 +447,7 @@ def login_submit(
                 status_code=429,
             )
 
-        user = db.execute(
-            select(User).where(User.email == email_clean)
-        ).scalar_one_or_none()
+        user = resolve_login_user(db, email_clean, _bound_domain_tenant_id(request))
 
         can_login, blocked_reason = _is_user_login_allowed(user)
         password_ok = bool(user and verify_password(password, user.password_hash))
@@ -744,9 +743,7 @@ def forgot_password_submit(
 
     db = CommonSessionLocal()
     try:
-        user = db.execute(
-            select(User).where(User.email == email_clean)
-        ).scalar_one_or_none()
+        user = resolve_login_user(db, email_clean, _bound_domain_tenant_id(request))
 
         request.session.pop("password_reset_user_id", None)
         request.session.pop("password_reset_email", None)

app/ui/templates/modules/auth/login.html

@@ -8,8 +8,8 @@
       <input type="hidden" name="csrf_token" value="{{ csrf_token }}" />
 
       <label class="grid gap-1">
-        <span class="text-sm text-slate-600">Email</span>
-        <input class="border rounded-xl px-3 py-2" name="email" type="email" required />
+        <span class="text-sm text-slate-600">Email or PAN</span>
+        <input class="border rounded-xl px-3 py-2" name="email" type="text" autocomplete="username" required />
       </label>
 
       <label class="grid gap-1">