Mock sign-in — any email and password works. No real authentication backend yet.