Sign-in interstitial page — shows email/password form + Google button.

Uses the same resolver as protected routes so a signature-valid uid cookie pointing at a missing user does NOT cause /home → /signin → /home loops; instead the stale cookie is cleared and the form is rendered. The next query parameter is sanitized to prevent open redirects (e.g. next=//evil.com).