fix(auth): fix disabled button styling and password policy JS serialization

Move .button into auth.scss at the .main_container level so the
.button:global(.Mui-disabled) override wins by specificity (0,3,0 vs
0,2,0) rather than depending on source order.

Harden shape_pattern and allowed_special_characters in register.blade.php
with Js::from(), matching the treatment already applied to the other
three passwordPolicy strings. {{ }} encodes & as & inside a script
block, which corrupted the regex character class and caused the client
to accept passwords the server rejects. Add PasswordPolicyRenderingTest
to guard against this class of rendering bug.

Author: mulldug

resources/js/reset_password/reset_password.module.scss

@@ -16,12 +16,6 @@
       text-align: center;
     }
 
-    .button {
-      width: 380px;
-      color: white;
-      background-color: $base-color-dark;
-    }
-
     .error_label {
       color: #f44336;
       font-size: 0.75rem;

resources/js/signup/signup.module.scss

@@ -20,12 +20,6 @@
       text-align: center;
     }
 
-    .button {
-      width: 380px;
-      color: white;
-      background-color: black;
-    }
-
     .error_label {
       color: #f44336;
       font-size: 0.75rem;

resources/styles/auth.scss

@@ -64,4 +64,15 @@
     letter-spacing: 0.5em;
   }
 
+  .button {
+    width: 380px;
+    color: white;
+    background-color: black;
+
+    &:global(.Mui-disabled) {
+      background-color: rgba(0, 0, 0, 0.12);
+      color: rgba(0, 0, 0, 0.26);
+    }
+  }
+
 }

resources/views/auth/register.blade.php

@@ -26,8 +26,8 @@
         const passwordPolicy = {
             min_length: {{ Config::get("auth.password_min_length") }},
             max_length: {{ Config::get("auth.password_max_length") }},
-            shape_pattern: '{{ Config::get("auth.password_shape_pattern") }}',
-            allowed_special_characters: '{{ Config::get("auth.password_allowed_special_characters") }}',
+            shape_pattern: '{{ Illuminate\Support\Js::from(Config::get("auth.password_shape_pattern")) }}',
+            allowed_special_characters: '{{ Illuminate\Support\Js::from(Config::get("auth.password_allowed_special_characters")) }}',
             allowed_special_characters_text: {{ Illuminate\Support\Js::from(Config::get("auth.password_allowed_special_characters_text")) }},
             shape_warning: {{ Illuminate\Support\Js::from(Config::get("auth.password_shape_warning")) }},
             shape_list: {{ Illuminate\Support\Js::from(Config::get("auth.password_shape_list")) }}

tests/PasswordPolicyRenderingTest.php

@@ -0,0 +1,53 @@
+<?php namespace Tests;
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use Illuminate\Support\Facades\Config;
+use Illuminate\Support\ViewErrorBag;
+
+class PasswordPolicyRenderingTest extends TestCase
+{
+    /**
+     * The regex the browser receives must classify passwords exactly as the
+     * server-side one does. Probes are all 10-30 chars so length is never the
+     * discriminator — only the special-character class is under test.
+     */
+    public function test_rendered_signup_pattern_agrees_with_server_pattern(): void
+    {
+        $html = view('auth.register', [
+            'countries'    => [],
+            'client_id'    => '',
+            'redirect_uri' => '',
+            'errors'       => new ViewErrorBag(),
+        ])->render();
+
+        $this->assertSame(1, preg_match('/shape_pattern:\s*(.+?),\R/', $html, $m));
+
+        // Resolve the \uXXXX escapes a JS parser would resolve in the literal.
+        // Trim both single quotes ({{ }} format) and double quotes (Js::from format).
+        $client = preg_replace_callback(
+            '/\\\\u([0-9a-fA-F]{4})/',
+            fn ($u) => mb_chr(hexdec($u[1])),
+            trim($m[1], "\"'")
+        );
+        $server = Config::get('auth.password_shape_pattern');
+
+        foreach (['Passwordma1', 'Passw0rdabc', ';Passw0rdaa', 'Valid1Pass!'] as $probe) {
+            $this->assertSame(
+                (bool) preg_match("/{$server}/", $probe),
+                (bool) preg_match("/{$client}/", $probe),
+                "rendered and server patterns disagree on '{$probe}'"
+            );
+        }
+    }
+}