Review pass on the Lightwell redesign: layout, copy and behavior fixes

Dialog buttons are Cancel then the primary action at the bottom right, and each page has one primary
action. List pages no longer repeat their title. Dates have the month written out. Fields in a row
line up, hints sit under fields instead of inside labels, and long certificate errors are clamped.
Organizations show whether local access is on and name the action; setting a user's password uses a
dialog instead of a browser prompt. Server errors for sign-in and ranges are reworded with a next step,
and the stray scrollbar inside tables is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mappings.go

@@ -87,7 +87,7 @@ func (s *Server) validateMapping(c *orgCtx, m *model.Mapping) error {
 			return errors.New("every target needs a host (e.g. 127.0.0.1 or 192.168.1.20)")
 		}
 		if t.Port < 1 || t.Port > 65535 {
-			return errors.New("target ports must be 1-65535")
+			return errors.New("Target ports must be between 1 and 65535.")
 		}
 	}
 	if m.BindIP == "" {
@@ -99,7 +99,7 @@ func (s *Server) validateMapping(c *orgCtx, m *model.Mapping) error {
 	}
 	m.BindIP = ip.String()
 	if m.Port < 1 || m.Port > 65535 {
-		return errors.New("public port must be 1-65535")
+		return errors.New("The public port must be between 1 and 65535.")
 	}
 	switch {
 	case m.PortEnd == 0 || m.PortEnd == m.Port:
@@ -107,7 +107,7 @@ func (s *Server) validateMapping(c *orgCtx, m *model.Mapping) error {
 	case m.PortEnd < m.Port:
 		return errors.New("the end of a port range can't be before its start")
 	case m.PortEnd > 65535:
-		return errors.New("public ports must be 1-65535")
+		return errors.New("Public ports must be between 1 and 65535.")
 	case m.Proto != model.ProtoTCP && m.Proto != model.ProtoUDP:
 		return errors.New("port ranges work for tcp and udp only")
 	case m.PortEnd-m.Port+1 > 1000:
@@ -193,7 +193,7 @@ func (s *Server) validateMapping(c *orgCtx, m *model.Mapping) error {
 		}
 	}
 	if m.HealthSeconds != 0 && m.HealthSeconds != -1 && (m.HealthSeconds < 5 || m.HealthSeconds > 3600) {
-		return errors.New("health check interval must be 5-3600 seconds, or off")
+		return errors.New("The health check interval must be 5 to 3600 seconds, or off.")
 	}
 
 	for _, o := range s.st.Mappings {
@@ -204,7 +204,7 @@ func (s *Server) validateMapping(c *orgCtx, m *model.Mapping) error {
 		if m.Proto == o.Proto && model.HostBased(m.Proto) && m.BindIP == o.BindIP && m.Hostname != o.Hostname {
 			continue // same listener, different hostname
 		}
-		return fmt.Errorf("%s port %s on %s is already used by %q", netClass(m.Proto), portLabel(*m), o.BindIP, o.Name)
+		return fmt.Errorf("%s port %s on %s is already used by %q. Choose another port or address.", strings.ToUpper(netClass(m.Proto)), portLabel(*m), o.BindIP, o.Name)
 	}
 	if m.Name == "" {
 		if m.Hostname != "" {
@@ -226,7 +226,7 @@ func portLabel(m model.Mapping) string {
 
 func checkPIN(p string) error {
 	if len(p) < 4 || len(p) > 12 {
-		return errors.New("a PIN is 4-12 digits")
+		return errors.New("A PIN is 4 to 12 digits.")
 	}
 	for _, c := range p {
 		if c < '0' || c > '9' {