Add session abstraction, mobile bearer auth, and pluggable SSO

Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).

Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
  (create/validate/partial-TOTP/revoke), session.middleware.js
  (attachSession/requireAuth/requireRole). utils/auth.js is now a thin
  compat facade so existing imports are unchanged.

Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
  long-lived refresh token, stored hashed and rotated on use, in a new
  mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
  TOTP. token.signToken gains a backward-compatible expiresIn option.

Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
  OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
  discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
  identities are never auto-provisioned. Client secrets encrypted at rest
  (AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
  account linking (/admin/account/identities). New auth_providers +
  user_identities tables.

Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
  graceful with zero providers). New Authentication admin view
  (Local/Google/Discord/Custom). Account page linked-accounts section.

Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/admin/admin.routes.js

@@ -8,6 +8,7 @@ const { body, param } = require('express-validator')
 const ctrl = require('./admin.controller')
 const account = require('./account.controller')
 const botActivity = require('./botActivity.controller')
+const authProviders = require('./authProviders.controller')
 const { isLoggedIn, requireRole } = require('../../../utils/auth')
 const noindex = require('../../../middleware/noindex')
 const validate = require('../../../middleware/validate')
@@ -38,6 +39,15 @@ adminRouter.post(
   account.totpDisable,
 )
 
+// Linked SSO identities (self-service — any logged-in role manages their own).
+adminRouter.get('/account/identities', account.listIdentities)
+adminRouter.delete(
+  '/account/identities/:provider',
+  param('provider').matches(/^[a-z0-9-]+$/),
+  validate,
+  account.unlinkIdentity,
+)
+
 // ── Image uploads (screenshots/gallery) ───────────────────────────────
 const UPLOAD_DIR =
   process.env.UPLOAD_DIR || path.join(__dirname, '..', '..', '..', '..', 'uploads')
@@ -191,6 +201,49 @@ adminRouter.post(
   botActivity.unbanIp,
 )
 
+// ── Authentication providers / SSO (admin only) ───────────────────────
+adminRouter.get('/auth/providers', adminOnly, authProviders.list)
+adminRouter.post(
+  '/auth/providers',
+  adminOnly,
+  body('id').matches(/^[a-z0-9-]+$/),
+  body('kind').isIn(['oidc', 'oauth2']),
+  body('name').isString().trim().notEmpty().isLength({ max: 80 }),
+  body('enabled').optional().isBoolean(),
+  body('clientId').optional({ values: 'falsy' }).isString(),
+  body('secret').optional({ values: 'falsy' }).isString(),
+  body('authorizeUrl').optional({ values: 'falsy' }).isURL({ require_tld: false }),
+  body('tokenUrl').optional({ values: 'falsy' }).isURL({ require_tld: false }),
+  body('userinfoUrl').optional({ values: 'falsy' }).isURL({ require_tld: false }),
+  body('scopes').optional({ values: 'falsy' }).isString().isLength({ max: 500 }),
+  body('priority').optional().isInt(),
+  validate,
+  authProviders.create,
+)
+adminRouter.put(
+  '/auth/providers/:id',
+  adminOnly,
+  param('id').matches(/^[a-z0-9-]+$/),
+  body('name').optional().isString().trim().notEmpty().isLength({ max: 80 }),
+  body('enabled').optional().isBoolean(),
+  body('clientId').optional({ values: 'falsy' }).isString(),
+  body('secret').optional({ values: 'falsy' }).isString(),
+  body('authorizeUrl').optional({ values: 'falsy' }).isURL({ require_tld: false }),
+  body('tokenUrl').optional({ values: 'falsy' }).isURL({ require_tld: false }),
+  body('userinfoUrl').optional({ values: 'falsy' }).isURL({ require_tld: false }),
+  body('scopes').optional({ values: 'falsy' }).isString().isLength({ max: 500 }),
+  body('priority').optional().isInt(),
+  validate,
+  authProviders.update,
+)
+adminRouter.delete(
+  '/auth/providers/:id',
+  adminOnly,
+  param('id').matches(/^[a-z0-9-]+$/),
+  validate,
+  authProviders.remove,
+)
+
 // ── User management (admin only) ──────────────────────────────────────
 adminRouter.use('/users', adminOnly)
 adminRouter.get('/users', ctrl.listUsers)