Review pass on the Lightwell redesign: layout, copy and behavior fixes

Dialog buttons are Cancel then the primary action at the bottom right, and each page has one primary
action. List pages no longer repeat their title. Dates have the month written out. Fields in a row
line up, hints sit under fields instead of inside labels, and long certificate errors are clamped.
Organizations show whether local access is on and name the action; setting a user's password uses a
dialog instead of a browser prompt. Server errors for sign-in and ranges are reworded with a next step,
and the stray scrollbar inside tables is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/design.md

@@ -40,6 +40,15 @@ Lucide style, outline only, stroke 1.75, round caps, `currentColor`. Sizes are 1
 
 Approved names: `fin`, `mine`, `ports`, `sites`, `domains`, `access`, `logs`, `edges`, `orgs`, `users`, `idps`, `settings`, `audit`, `account`, `egress`, `alerts`, `out`, `menu`, `close`, `add`, `check`, `light`, `dark`, `alert`. Add a name here and in `ICONS` together.
 
+## Patterns
+
+* **One primary action per view.** It sits in the page header. Smaller forms inside a page use the default button.
+* **List pages** show the page header, then the table in a card with no second title.
+* **Dialogs and forms** end with Cancel and then the primary action, at the bottom right. Labels sit above fields, and rules such as "At least 8 characters" are hints below them, not part of the label.
+* **Dates** have the month written out ("Nov 2, 2026"), with `fmtDate` and `fmtTime`.
+* **Empty states** say why the list is empty: nothing yet, or nothing matching the filters.
+* **Long machine messages**, such as certificate errors, wrap and stop at three lines (`.clip`), with the full text in a tooltip.
+
 ## Layout
 
 * Admin content is capped at 1120px. Below 860px the sidebar becomes a slide-in drawer with a top bar, and grids collapse. Phones keep a 16px side gutter.