Remove the login box frame and hide "Lost your password?" reliably

- No border or shadow around the login box on wp-login.php (form and
  Microsoft block, also in button-only mode); the white area stays.
- Button-only mode: the "Lost your password?" link is removed through
  lost_password_html_link instead of CSS only, the lostpassword,
  retrievepassword, rp and resetpass screens redirect to the login page
  and allow_password_reset refuses resets – all unless the fallback link
  is active.
- The login stylesheet is also loaded when only the form is hidden
  (e.g. broken connection); before, the link and form showed there.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -27,7 +27,11 @@ All notable changes to this project are documented in this file. The format foll
 - "Link Microsoft account" on the profile screen (the signed-in user binds their own Microsoft account) and an administrator-assigned Microsoft account (UPN) per user – for administrators whose user principal name differs from their e-mail address. Sign-in finds bound accounts by object ID first, then by assigned UPN, then by e-mail.
 - Privacy exporter and eraser for the data the plugin copies.
 
+### Changed
+- No frame around the login box (form and Microsoft block) on wp-login.php.
+
 ### Fixed
+- Button-only mode: the "Lost your password?" link is removed server-side, the lost-password and reset screens redirect to the login page and password resets are refused (unless the fallback link is active); the login stylesheet is also loaded while the connection is broken, so the password form stays hidden.
 - Accounts whose WordPress e-mail is the user principal name (while the Microsoft mail differs) were not found at sign-in and got a duplicate account from the sync; sign-in and sync now try the mail address and the UPN.
 
 ### Security