Fix login card nesting on htmx failure

- Add id="login-card" to the .card wrapper div
- Change hx-target to #login-card (was #login-form)
- Add hx-select="#login-card" so htmx extracts only
  the card element from the full-page response

Without hx-select, htmx replaced the form's outerHTML
with the entire page response, inserting a new .card
inside the existing .card on every failed attempt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/templates/login.html

@@ -11,10 +11,10 @@
   <div class="login-box">
     <div class="brand-heading">MCIAS</div>
     <div class="brand-subtitle">Metacircular Identity &amp; Access System</div>
-    <div class="card">
+    <div class="card" id="login-card">
       {{if .Error}}<div class="alert alert-error" role="alert">{{.Error}}</div>{{end}}
       <form id="login-form" method="POST" action="/login"
-            hx-post="/login" hx-target="#login-form" hx-swap="outerHTML">
+            hx-post="/login" hx-target="#login-card" hx-swap="outerHTML" hx-select="#login-card">
         <div class="form-group">
           <label for="username">Username</label>
           <input class="form-control" type="text" id="username" name="username"