Wait for content the page owns before scanning it

Several accessibility scans ran against a page that had not finished
arriving, so axe reported violations the app does not have. The worst of
them was the medications case, which waited for a level-one heading and
then checked that a level-one heading exists. A page that really lost its
heading would have waited out the timeout under a misleading name instead
of failing the rule, which makes it a check that cannot fail rather than a
flaky one.

The filter rail was the other bad sentinel. It renders beside the loading
silhouettes rather than after them, so it was on screen while the rows were
still grey rectangles. Under an 8x CPU throttle the rail and the loading
marker resolved in the same 40ms poll and the rows a poll later.

Every case now gates on a marker the real component carries in its
resolved, non-empty branch, and on a component other than the one the scan
asserts. Both the desktop table and the mobile card list carry the same
marker so the wait holds at any viewport. No sentinel names a heading, the
app frame, a busy marker or the filter rail any more.

src/app/auth/login/page.tsx

@@ -363,7 +363,14 @@ export default function LoginPage() {
             />
           </div>
         ) : (
-          <div className="mt-8 space-y-4">
+          <div
+            // The login card's own action block. `<main>` around it belongs
+            // to the shell and is on screen before this page renders at all,
+            // so it is this marker, not the landmark, that says the form has
+            // arrived.
+            data-slot="login-actions"
+            className="mt-8 space-y-4"
+          >
             {oidcStatus?.enabled && (
               <Button
                 onClick={handleOidcLogin}