Add session abstraction, mobile bearer auth, and pluggable SSO

Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).

Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
  (create/validate/partial-TOTP/revoke), session.middleware.js
  (attachSession/requireAuth/requireRole). utils/auth.js is now a thin
  compat facade so existing imports are unchanged.

Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
  long-lived refresh token, stored hashed and rotated on use, in a new
  mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
  TOTP. token.signToken gains a backward-compatible expiresIn option.

Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
  OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
  discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
  identities are never auto-provisioned. Client secrets encrypted at rest
  (AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
  account linking (/admin/account/identities). New auth_providers +
  user_identities tables.

Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
  graceful with zero providers). New Authentication admin view
  (Local/Google/Discord/Custom). Account page linked-accounts section.

Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/db/schema.sql

@@ -119,6 +119,63 @@ CREATE TABLE IF NOT EXISTS activity_log (
   INDEX idx_activity_created (created_at)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 
+-- Pluggable SSO / OAuth2 provider configuration. Rows exist for the built-in
+-- providers ('google', 'discord') once an admin configures them, plus any custom
+-- OIDC/OAuth2 providers (id = a slug). Client secrets are stored ENCRYPTED
+-- (client_secret_enc) and are never returned to a client. Built-in providers
+-- hardcode their endpoint URLs in code; the *_url columns are used only by
+-- custom (oidc/oauth2) providers.
+CREATE TABLE IF NOT EXISTS auth_providers (
+  id                VARCHAR(64) PRIMARY KEY,   -- 'google' | 'discord' | custom slug
+  kind              ENUM('google','discord','oidc','oauth2') NOT NULL,
+  name              VARCHAR(80)  NOT NULL,
+  enabled           TINYINT(1)   NOT NULL DEFAULT 0,
+  client_id         VARCHAR(255) NULL,
+  client_secret_enc TEXT         NULL,         -- AES-256-GCM ciphertext, never exposed
+  authorize_url     VARCHAR(500) NULL,         -- custom providers only
+  token_url         VARCHAR(500) NULL,
+  userinfo_url      VARCHAR(500) NULL,
+  scopes            VARCHAR(500) NULL,
+  priority          INT          NOT NULL DEFAULT 100,
+  created_at        DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at        DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Account linking: maps an external SSO identity to an internal user. A login via
+-- SSO succeeds only if a matching (provider, subject) row exists (link-only —
+-- external identities are never auto-provisioned into accounts). UNIQUE(provider,
+-- subject) guarantees one external identity maps to exactly one internal user.
+CREATE TABLE IF NOT EXISTS user_identities (
+  id         INT AUTO_INCREMENT PRIMARY KEY,
+  user_id    INT NOT NULL,
+  provider   VARCHAR(64)  NOT NULL,            -- matches auth_providers.id
+  subject    VARCHAR(191) NOT NULL,            -- external stable user id (sub / discord id)
+  email      VARCHAR(255) NULL,
+  created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT fk_identity_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+  UNIQUE KEY uq_identity_provider_subject (provider, subject),
+  INDEX idx_identity_user (user_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Long-lived, revocable refresh tokens for mobile (Android) bearer-token auth.
+-- The opaque refresh token is never stored in the clear — only its sha256 hash —
+-- so a DB read does not leak usable tokens. Rows are rotated on every refresh
+-- (old row revoked, new row inserted) and revoked on logout. Web cookie sessions
+-- do NOT use this table; it is purely for the mobile bearer flow.
+CREATE TABLE IF NOT EXISTS mobile_refresh_tokens (
+  id          INT AUTO_INCREMENT PRIMARY KEY,
+  user_id     INT NOT NULL,
+  token_hash  CHAR(64)     NOT NULL UNIQUE,   -- sha256 hex of the opaque refresh token
+  device_hash VARCHAR(32)  NULL,              -- from sessionService.sessionMeta (best-effort)
+  user_agent  VARCHAR(255) NULL,
+  created_at  DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  expires_at  DATETIME NOT NULL,
+  revoked_at  DATETIME NULL,
+  CONSTRAINT fk_mrt_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+  INDEX idx_mrt_user (user_id),
+  INDEX idx_mrt_expires (expires_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
 -- Migrations for databases created before the wiki upgrade. Each statement uses
 -- IF NOT EXISTS so re-running on every boot is a harmless no-op. New installs get
 -- these columns from the CREATE TABLE above; existing installs get them here.