Form labels are always visually hidden on SimpleLogin pages, causing accessibility issues

Problem/Motivation

SimpleLogin unconditionally sets #title_display = 'invisible' on all text, email, and password form fields across the login, registration, and password reset forms. This means field labels are exposed only to screen readers through the .visually-hidden CSS class, while sighted users must rely entirely on placeholder text.

This pattern creates accessibility issues related to several WCAG 2.2 success criteria:

• SC 3.3.2 Labels or Instructions (Level A) - users need labels or instructions when a field requires input. Placeholder text alone is not a reliable substitute because it disappears once the user starts typing.
• SC 2.4.6 Headings and Labels (Level AA) - where labels are provided, they need to clearly describe the purpose of the field. Hiding the visible label and relying on placeholder text makes that purpose harder to review while completing the form.
• SC 1.3.1 Info and Relationships (Level A) - this may apply if the label relationship is not programmatically determinable. If the hidden labels remain correctly associated with their fields, this criterion is less directly affected.

The behavior is hard-coded in three places:

1. simplelogin_form_alter() user_register_form (username, email, …)
2. simplelogin_form_alter() user_login_form / user_pass (fall-through case)
3. simplelogin_password_confirm() password confirm element processor (both pass1 and pass2)

There is no way for a site administrator to restore visible labels without patching the module.

Steps to reproduce

1. Install the SimpleLogin module and navigate to /user/login, /user/register, or /user/password.
2. Observe that no visible labels are rendered above the input fields; only placeholder text is present.
3. Begin typing in any field: the placeholder disappears, leaving no visible indication of what the field expects.
4. Run an automated accessibility audit against any of those pages.

Proposed resolution

Add a boolean configuration setting, visually_hidden_labels, to simplelogin.settings that controls whether #title_display = 'invisible' is applied to form fields.

• Default value: true preserves the existing visual behavior for sites already running the module, so no unintended visual regression occurs on upgrade.
• When set to false, all three label-hiding code paths are skipped, restoring fully visible labels and meeting WCAG 2.2 Level AA requirements.

The setting is exposed in the existing SimpleLogin admin settings form (/admin/config/simplelogin) as a labeled checkbox with a description explaining the accessibility implications.

A ?? TRUE fallback is used in both the module logic and the form's #default_value to handle existing installations where the config key does not yet exist in the database.

Additionally, the simplelogin_password_confirm() processor is updated to use $element['pass1']['#attributes']['placeholder'], the correct Drupal Form API key, instead of the non-standard $element['pass1']['#placeholder'] that was previously used.

Remaining tasks

• [ ] Review the patch / merge request
• [ ] Commit and tag a new release once the fix is merged.

User interface changes

A new "Visually hide form labels" checkbox is added to the SimpleLogin configuration form at /admin/config/simplelogin, inside the existing Configuration fieldset.

• Label: Visually hide form labels
• Description: Hide form field labels on SimpleLogin pages and use placeholder text instead. Disable this option to show visible labels for better WCAG 2.2 accessibility compliance.
• Default: Checked (on) preserves existing behavior.

API changes

Not applicable.

Data model changes

A new boolean key, visually_hidden_labels, is added to the simplelogin.settings configuration object.

• config/install/simplelogin.settings.yml install default: visually_hidden_labels: true
• config/schema/simplelogin.schema.yml typed as boolean, labeled "Visually hide form labels"