Privacy
The portal stores one thing in your browser, and it is the one that keeps you signed in. There is no analytics, no advertising, no tracking, and nothing that follows you to another site — so there is nothing here to consent to or decline.
sb-<project>-auth-token
Keeps you signed in. It holds the session issued when you enter your password and second factor, and is what tells the portal which artist you are on every page.
Duration: Until you sign out, or the session expires. Removing it signs you out.
Strictly necessary — the portal cannot work without it.
Consent is required for storage that is not strictly necessary for a service you have asked for. Signing in to a private portal is such a request, and the cookie above is what carries that sign-in. There is nothing else stored, so a banner would offer you a choice that does not exist. If you would rather not have it, the portal simply cannot sign you in.
The sign-in and password-reset forms run a Cloudflare Turnstile check to confirm the request comes from a person. It is used instead of a puzzle-based CAPTCHA specifically because it sets no cookie and stores nothing in your browser. Cloudflare receives the request in order to make that judgement; see the privacy notice for the processors involved.
Checked by inspecting the browser directly rather than from documentation: one cookie, empty localStorage, empty sessionStorage, and nothing left behind by the sign-in bot check.