feat: login page says a locked instance is suspended instead of drawing the form

web/app/login/page.tsx

@@ -22,6 +22,7 @@ const ERROR_MESSAGES: Record<string, string> = {
     session_failed: "Could not start your session. Please try again.",
     state_failed: "Could not start sign-in. Please try again.",
     unknown_host: "This address does not name a known instance.",
+    instance_locked: "Access to this instance is suspended.",
 };
 
 export default function LoginPage() {
@@ -33,16 +34,24 @@ export default function LoginPage() {
     // usable rather than an empty card.
     const [localEnabled, setLocalEnabled] = useState(true);
     const [ssoError, setSsoError] = useState("");
+    // Vantage HQ has locked this instance under an account dispute. The page
+    // says so instead of drawing a form that cannot sign anyone in.
+    const [locked, setLocked] = useState(false);
 
     useEffect(() => {
         const code = new URLSearchParams(window.location.search).get("error");
-        if (code) setSsoError(ERROR_MESSAGES[code] ?? "Sign-in failed. Please try again.");
+        if (code === "instance_locked") setLocked(true);
+        else if (code) setSsoError(ERROR_MESSAGES[code] ?? "Sign-in failed. Please try again.");
     }, []);
 
     useEffect(() => {
         (async () => {
             try {
                 const s = await auth.bootstrapStatus();
+                if (s.locked) {
+                    setLocked(true);
+                    return;
+                }
                 if (s.needs_setup) {
                     window.location.href = "/setup";
                     return;
@@ -51,6 +60,10 @@ export default function LoginPage() {
             } catch {}
             try {
                 const p = await auth.providers();
+                if (p.locked) {
+                    setLocked(true);
+                    return;
+                }
                 setProviders(p.providers);
                 setLocalEnabled(p.local_enabled);
             } catch {}
@@ -86,11 +99,19 @@ export default function LoginPage() {
             <div className="relative w-full max-w-sm">
                 <div className="mb-8 flex flex-col items-center gap-3">
                     <Logo className="h-11 w-auto text-logo" />
-                    <h1 className="text-2xl font-extrabold tracking-[-0.03em] text-text-primary">Sign in to Vantage</h1>
+                    <h1 className="text-2xl font-extrabold tracking-[-0.03em] text-text-primary">{locked ? "Instance unavailable" : "Sign in to Vantage"}</h1>
                     {/* A keyed label, not a heading: site/'s .tag treatment. */}
-                    <p className="font-mono text-[0.7rem] uppercase tracking-[0.15em] text-text-secondary">{instanceName}</p>
+                    {!locked && <p className="font-mono text-[0.7rem] uppercase tracking-[0.15em] text-text-secondary">{instanceName}</p>}
                 </div>
 
+                {locked ? (
+                    <Card>
+                        <div className="rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-sm text-warning">Access to this instance is suspended.</div>
+                        <p className="mt-4 text-sm text-text-secondary">
+                            Nobody can sign in, and its servers are not being managed, until this is resolved. If you manage this account, check your email from Vantage for details.
+                        </p>
+                    </Card>
+                ) : (
                 <Card>
                     {ssoError && <div className="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">{ssoError}</div>}
 
@@ -155,6 +176,7 @@ export default function LoginPage() {
                         </div>
                     )}
                 </Card>
+                )}
             </div>
         </div>
     );

web/lib/api.ts

@@ -443,6 +443,8 @@ export interface MeResponse {
 export interface BootstrapStatus {
     needs_setup: boolean;
     instance_name?: string;
+    /** Vantage HQ has locked this instance; the login page shows a message instead of the form. */
+    locked?: boolean;
 }
 
 export interface BootstrapResponse {
@@ -479,6 +481,7 @@ export interface PublicProvider {
 export interface ProvidersResponse {
     local_enabled: boolean;
     providers: PublicProvider[];
+    locked?: boolean;
 }
 
 export interface AuthProvider {