debug: add console logging to login form for error visibility

Logs success payload (sans secrets — just success/migrated/legacy/uid/
email/hasToken booleans) and the post-login document.cookie state so
DevTools can show whether the auth cookie actually landed in the
browser before the /contributor redirect runs.

src/app/client-login/page.tsx

@@ -28,18 +28,27 @@ export default function ClientLoginPage() {
       const data = await res.json();
 
       if (!res.ok) {
-        setError(data.error || 'Login failed');
-        console.error('Login error:', data);
+        const errMsg = data.error || `Server error: ${res.status}`;
+        console.error('Login API error:', errMsg, data);
+        setError(errMsg);
         return;
       }
 
+      console.log('Login success, data:', {
+        success: data.success,
+        migrated: data.migrated,
+        legacy: data.legacy,
+        userId: data.user?.id,
+        userEmail: data.user?.email,
+        hasAccessToken: !!data.session?.access_token,
+      });
+      console.log('Cookies visible to JS now:', document.cookie || '(none)');
+      console.log('About to redirect to /contributor');
+
       // The wp-login API has already set the supabase session cookie via
-      // its NextResponse. Do a HARD reload to /contributor so the server
-      // re-renders with that cookie and the browser supabase client
-      // boots up reading it from document.cookie. Avoids the cookie-flag
-      // mismatch that happens if we try to setSession() client-side
-      // (browser client writes Secure;SameSite=None, server writes
-      // SameSite=Lax — they conflict).
+      // its NextResponse. Hard reload so the server re-renders with the
+      // cookie and the browser supabase client picks it up from
+      // document.cookie on page load.
       window.location.href = '/contributor';
     } catch (err: any) {
       setError(err.message || 'An error occurred');