Description

The admin Add user dialog lets an operator create an account with either an
email or a plain username, and the backend accepts both: the /login and
/register endpoints pass the value straight to authenticate() /
RegisterRequest, whose validator explicitly allows "a standard email address
or a plain username" (deeptutor/api/routers/auth.py).

But the login and register forms hardcoded the identity field as
type="email", so the browser's native HTML5 validation rejected anything
without an @ ("Please include an '@' in the email address"). The result: you
could create a username-only account from the admin panel, but never sign in
with it — the form blocked submission before the request was even sent.

This change makes the frontend match the admin dialog and the backend:

• type="email" → type="text" (drops the browser's email-only validation)
• autoComplete="email" → autoComplete="username"
• label Email → Email or username (added to both en and zh locales)

No backend changes — it already supported username login.

Related Issues

• N/A — not previously tracked.

Module(s) Affected

• agents
• api
• config
• core
• knowledge
• logging
• services
• tools
• utils
• web (Frontend)
• docs (Documentation)
• scripts
• tests
• Other: ...

Checklist

• I have read and followed the contribution guidelines.
• My code follows the project's coding standards.
• I have run pre-commit run --all-files and fixed any issues.
• I have added relevant tests for my changes.
• I have updated the documentation (if necessary).
• My changes do not introduce any new security vulnerabilities.

Additional Notes

Before / After

Before (type="email" blocks a username)	After (Email or username)

Tests — added tests/multi_user/test_login_username_contract.py, locking the
backend contract the form relies on so a future change (e.g. swapping the field
for pydantic.EmailStr) can't silently break username login again:

• RegisterRequest accepts an email or a bare username; rejects empty/garbage
  and passwords shorter than 8 chars.
• LoginRequest imposes no email-only or password-length validation.
• authenticate() round-trips a user created with a plain username.

Note on pre-commit — all hooks pass on the changed files except
check-json, which flags a pre-existing duplicate key ("Space tooltip") in
web/locales/{en,zh}/app.json. That duplicate is already present on dev and is
unrelated to this PR; happy to fix it in a separate change if useful.