Add phase 6 PAN login invitation and client identity

app/ui/routes/auth.py

@@ -19,6 +19,7 @@ from app.core.templating import templates
 from app.core.settings import get_settings
 from app.modules.core.iam.invite_service import accept_invite, reset_password_with_token
 from app.modules.core.iam.models import LoginAttempt, User
+from app.modules.client_identity.service import mark_identity_activated, resolve_login_user
 from app.modules.core.rbac.models import Permission, Role, RolePermission, UserRole
 from app.modules.core.tenancy.models import Branch, FinancialYear, Tenant
 from app.modules.core.tenancy.settings_models import BranchSettings
@@ -446,9 +447,7 @@ def login_submit(
                 status_code=429,
             )
 
-        user = db.execute(
-            select(User).where(User.email == email_clean)
-        ).scalar_one_or_none()
+        user = resolve_login_user(db, email_clean, _bound_domain_tenant_id(request))
 
         can_login, blocked_reason = _is_user_login_allowed(user)
         password_ok = bool(user and verify_password(password, user.password_hash))
@@ -744,9 +743,7 @@ def forgot_password_submit(
 
     db = CommonSessionLocal()
     try:
-        user = db.execute(
-            select(User).where(User.email == email_clean)
-        ).scalar_one_or_none()
+        user = resolve_login_user(db, email_clean, _bound_domain_tenant_id(request))
 
         request.session.pop("password_reset_user_id", None)
         request.session.pop("password_reset_email", None)