I fixed the problem. I isolated the problem to settings inheritance from the root web application's web.config.
I had to override two settings sections in the web.config in the dnn root directory to get the DNN login working correctly. I overrode the parent folder's <authorization> section:
<authorization>
<deny users="?"/>
</authorization>
I also had to override a duplicate httpModule ScriptModule reference from the parent folder's web.config, to get the website running:
<add name="ScriptModule" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
The added two entries in my DNN site's web.config that look like this:
<system.web>
<httpModules>
<!-- Be careful not to use the <clear /> tag here! That breaks the login process. -->
<remove name="ScriptModule" />
</httpModules>
<authorization>
<allow users="*,?" />
</authorization>
</system.web>
A good troubleshooting tool for your web.config settings can be found in IIS, under the ASP.NET tab of the virtual directory's properties. There, you can click on "Edit Configuration" to view not only the settings from the web.config file in the current virtual folder, but also all inherited settings from the upstream heirarchy, including the root IIS directory's web.config. That way you can see the accumulated web.config settings from the entire inheritance heirarchy.