Add session abstraction, mobile bearer auth, and pluggable SSO

Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).

Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
  (create/validate/partial-TOTP/revoke), session.middleware.js
  (attachSession/requireAuth/requireRole). utils/auth.js is now a thin
  compat facade so existing imports are unchanged.

Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
  long-lived refresh token, stored hashed and rotated on use, in a new
  mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
  TOTP. token.signToken gains a backward-compatible expiresIn option.

Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
  OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
  discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
  identities are never auto-provisioned. Client secrets encrypted at rest
  (AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
  account linking (/admin/account/identities). New auth_providers +
  user_identities tables.

Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
  graceful with zero providers). New Authentication admin view
  (Local/Google/Discord/Custom). Account page linked-accounts section.

Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/admin/account.controller.js

@@ -4,6 +4,7 @@
 
 const users = require('../../../model/users/users.model')
 const activity = require('../../../model/activity/activity.model')
+const userIdentities = require('../../../model/userIdentities/userIdentities.model')
 const totp = require('../../../utils/totp')
 
 const log = require('../../../utils/logger')('account')
@@ -81,4 +82,32 @@ async function totpDisable(req, res) {
   }
 }
 
-module.exports = { getAccount, totpSetup, totpEnable, totpDisable }
+// ── Linked SSO identities (self-service) ──────────────────────────────────
+// List the external accounts (Google/Discord/…) linked to the current user.
+// Linking itself happens via the SSO redirect flow (/auth/sso/:provider/link).
+async function listIdentities(req, res) {
+  try {
+    const rows = await userIdentities.listForUser(req.user.id)
+    return res.json(rows.map((r) => ({ provider: r.provider, email: r.email, linked_at: r.created_at })))
+  } catch (err) {
+    log.error('listIdentities', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
+// Remove a linked SSO identity from the current user's account.
+async function unlinkIdentity(req, res) {
+  const { provider } = req.params
+  try {
+    const removed = await userIdentities.unlink(req.user.id, provider)
+    if (!removed) return res.status(404).json({ message: 'No linked account for that provider.' })
+    await activity.log({ req, action: 'auth.sso.unlink', detail: { provider } })
+    log.info('sso identity unlinked', { provider, id: req.user.id })
+    return res.json({ unlinked: true })
+  } catch (err) {
+    log.error('unlinkIdentity', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
+module.exports = { getAccount, totpSetup, totpEnable, totpDisable, listIdentities, unlinkIdentity }