Every polite touch on a login or password-reset flow is also a signal an attacker reads. A tour of how helpful auth UX leaks — and why the fix is to be gloriously boring.