bregctl dev issuer sign-in page: disabled sign-up and recovery actions, marketing copy, console noise

## Use Case

A developer opens a local host backed by the `bregctl dev` issuer and signs in as a synthetic user, by hand or from a Playwright test.

## What we hit

The dev issuer's sign-in page is stock ThunderID and reads like a product page rather than a local development fixture:

- it shows sign-up and forgot-password actions, although the rendered issuer description disables self registration, registration flows and recovery flows (`crates/registry-thunderid-tooling/src/render.rs`), so those actions lead nowhere;
- it carries ThunderID marketing copy beside the form;
- every load logs Content Security Policy violations for inline styles and a `401` for `/favicon.ico` in the browser console, which browser tests that assert a clean console have to filter.

## Proposed Behavior

- Hide the sign-up and recovery actions when the rendered description disables those flows (through ThunderID's branding or flow configuration, if it offers a supported switch).
- Replace the marketing panel with a short "local development issuer, synthetic users only" note, if the pinned image supports it.
- Remove the console noise, or document it with the exact messages so tests can filter it deliberately.

## Boundaries

- Only what the pinned ThunderID image supports through configuration; no forked image.
- If a point needs an upstream change, record it and close it here.

Start in crates/registry-thunderid-tooling/src/render.rs and inspect the rendered issuer description alongside the pinned ThunderID image configuration. Reproduce the sign-in page manually or from the mentioned Playwright test, recording action visibility, marketing copy, CSP violations, and the favicon 401. Done means supported configuration handles these issues, or any upstream limitation is recorded with the exact console messages.

Written by the indexing model from the issue text.