Show a sign-in code as two steps, each with its own action

[artyomsv]

Why

The prompted subscription sign-in panel showed a link, a code and a countdown in a plain column and
read as unfinished. The operator also asked for a copy button beside the code, and a button beside the
link that copies the code and opens the page.

What changed

• New HarnessSignInCode: two numbered steps in the order they are used.
  1. Open the sign-in page — the link, plus an icon button that copies the code, then opens the
     page in a new tab (noopener,noreferrer). Copy comes first: a browser refuses a clipboard write
     once the new tab has focus.
  2. Enter this code — shown large and spaced, with a copy icon button.
• A status line says what was just copied, or how long the code has left.
• The link and its open button are offered only for an https address (second lock; the worker already
  accepts only the vendor host).
• WIDGETS.md lists the new widget.

Verification

• UI: 921 tests pass (4 new), TypeScript and production build pass.
• Mutation checks: opening before copying, opening without copying, accepting a non-https address, and
  dropping noopener each fail a test.