chore: show warning on sign in page when sessionCookieSecret is missing

[stevenle]

Motivation

• Provide a clear developer-facing warning on the CMS sign-in page when server.sessionCookieSecret is not configured in development to reduce accidental insecure setups.

Description

• Add a warning field to the server-side rendering context in renderSignIn that is set when process.env.NODE_ENV === 'development' and options.rootConfig.server?.sessionCookieSecret is missing.
• Inject the warning into the client context window.__ROOT_CTX so the sign-in frontend can access it.
• Update the sign-in frontend to declare the warning in the global type, read window.__ROOT_CTX.warning, and render a .signin__warning banner when present.
• Add styles for .signin__warning in packages/root-cms/signin/styles/signin.css to visually highlight the warning.

Testing

• No automated tests were added or run for this change.

---

Codex Task

[stevenle]

on dev, an explicit warning is displayed:

on prod, a generic warning instead with suggestion to check logs:

:

[jeremydw]

LGTM