fix(auth): replace the sign-in page in the history after signing in

Back after signing in, registering or taking over a profile showed the
form that had just been submitted, because each pushed the next page
on top of it. Password, passkey and second-factor sign-in, registration
and the password take-over now replace the page instead.

src/components/auth/__tests__/claim-profile.browser.test.tsx

@@ -2,9 +2,10 @@
  * Taking over a managed profile, driven by the claim page's buttons.
  *
  * Both ways in start a session for a different account than whatever this
- * browser held before: the password claim stays in the single-page app and
- * starts from an empty cache, the single-sign-on claim leaves for the
- * identity provider and clears the offline copies before it goes.
+ * browser held before: the password claim stays in the single-page app,
+ * starts from an empty cache and replaces the claim page in the history; the
+ * single-sign-on claim leaves for the identity provider and clears the
+ * offline copies before it goes.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { page } from "vitest/browser";
@@ -16,6 +17,7 @@ import {
   type FetchStub,
 } from "../../../../tests/browser/fetch-stub";
 import { renderWithApp } from "../../../../tests/browser/render";
+import { recordHistory } from "../../../../tests/browser/url";
 
 const clearOffline = vi.hoisted(() => vi.fn(async () => {}));
 const loadDocument = vi.hoisted(() => vi.fn());
@@ -70,6 +72,7 @@ async function click(slot: string): Promise<void> {
 
 describe("ClaimProfile", () => {
   it("starts the claimed account from an empty cache", async () => {
+    const history = recordHistory();
     const { queryClient } = await renderWithApp(
       <ClaimProfile token={TOKEN} />,
       {
@@ -87,6 +90,7 @@ describe("ClaimProfile", () => {
       .poll(() => window.location.pathname)
       .toBe("/onboarding/handover");
     expect(api.calls("POST", "/api/auth/claim")).toHaveLength(1);
+    expect(history.pushes()).toEqual([]);
     expect(queryClient.getQueryData(queryKeys.dashboardSnapshot())).toBe(
       undefined,
     );

src/components/auth/claim-profile.tsx

@@ -122,7 +122,7 @@ export function ClaimProfile({
         onSuccess: () => {
           // As after any sign-in: nothing cached before belongs to this account.
           queryClient.clear();
-          router.push("/onboarding/handover");
+          router.replace("/onboarding/handover");
         },
       },
     );