Password step 400 — Auth0 tenant migrated to new React Universal Login (ULP 1.125 / react-components 1.202, custom af-form)

[cistone]

• Integration v0.5.3 (latest), HA 2026.7.4, Docker Container install.
• Symptom: identifier step succeeds (302 → /u/login/password), but the password POST https://auth.ecobee.com/u/login/password returns HTTP 400 with no data-error-code. Credentials are correct.
• This is a genuine Auth0 response, not a bot/WAF block or rate-limit: headers include X-Auth0-RequestId, X-Auth0-L, X-RateLimit-Remaining: 422.
• The 400 body is Auth0's new React ULP, not the classic form:
  • custom-form markup: af-custom-form-container / af-form (Auth0 Forms)
• Conclusion: the tenant switched to the new React Universal Login with custom Forms; the direct POST state/username/password/action=default to /u/login/password is no longer accepted. The scripted _password_step / _post_login_form flow needs to be reworked for the new ULP.