Lockable follow-ups: warnings, messages, specs, and CSS fix

[maebeale]

Summary

Follow-up to #1069 (which added :lockable to the User model). This PR adds the remaining lockable-related changes:

• Change confirmed user icon from green to gray on User. index
• Add login system spec covering locked, inactive, failed attempts, and success flows
• Enable last_attempt_warning in Devise config (warns on 9th attempt before 10th locks)
• Update Devise failure messages to use generic language that doesn't reveal account status
• Fix Safari CSS issue where password field stars weren't displaying

Test plan

• Verify login spec passes (rspec spec/system/login_spec.rb)
• Verify 9th failed login attempt shows last-attempt warning
• Verify 10th failed attempt locks the account
• Verify error messages don't reveal whether an account exists, is locked, or is inactive
• Verify password stars display correctly in Safari

🤖 Generated with Claude Code