Explicit login page: /login provider choice (X/IG), /test gate -> /login, anon opt-out removed, IG flow via identity cookie