fix(auth): close the modal regressions and keep the header component off /sign/

Three defects slipped into the sign-card rebuild:

The hidden-glyph rule was dropped. `.fa` sets display:inline-block, which
outranks the UA [hidden] rule, so every hidden glyph stayed visible — most
visibly a spinner rendered beside the login button at rest. `.sign [hidden]`
restores the override.

Closing account login produced an empty shell. The whole sign-in pane was
gated on `!$close_signin`, and the social block carried the same gate, so a
site with account login off but registration on still opened on an empty
panel with no social entry. The pane is now rendered in three shapes: open
registration falls through to the signup tab, a QR entry falls through to
the QR tab, social-only renders a notice plus the social bar, and when
nothing is available it states that login is closed.

The modal close button sat in normal flow and pushed the card content down;
`#u_sign .sign > .close` pins it back to the top-right corner.

The /sign/ route is `index.php?jio_sign=1`, so WordPress reports it as home.
The header multifunction component resolves page type by query flags and the
home branch won, so the component appeared on the auth page whenever "首页"
was in its scope — even though the sign page template itself was already
excluded. `jio_header_slide_current_page_type()` now bails out on `jio_sign`
before any of the is_* checks.

The breakpoint overrides that were fighting the shared sheet between 641px
and 991px are narrowed to the one offset that actually needed adjusting.

Verification: the modal was rendered through a PHP stub, served with the real
theme stylesheets, and driven by the real auth.js in a headless browser —
tab switching, signin-mode switching, password reveal, close button and
geometry at 1440/1100/900/760/500/390px. The header harness gained a
`jio_sign` case asserting no markup, and 860 widget/navigation tests pass.

tests/widget-system/header-multifunction-render.test.cjs

@@ -42,6 +42,13 @@ test('header multifunction renders reference slide, search, and card contracts o
   assert.match(moduleBackground, /<div class="icon-cover-card flex ac padding-10">Card one<\/div>/);
   assert.equal(JSON.parse(rendered.stdout).page_config_save.show_widget_bg, true);
 
+  // /sign/ resolves to index.php?jio_sign=1, so WordPress still reports it as
+  // home; the component must stay off even when "首页" is in its scope list.
+  const { auth_page_show: authShow, auth_page_type: authType, auth_page_markup: authMarkup } = JSON.parse(rendered.stdout);
+  assert.equal(authShow, false);
+  assert.equal(authType, '');
+  assert.equal(authMarkup, '');
+
   const { lazy_disabled: eager, single_slide: single } = JSON.parse(rendered.stdout);
   assert.match(eager, /<img class="radius8" src="https:\/\/example\.test\/eager\.jpg"/);
   assert.doesNotMatch(eager, /data-src=|lazyload/);