Add session abstraction, mobile bearer auth, and pluggable SSO

Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).

Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
  (create/validate/partial-TOTP/revoke), session.middleware.js
  (attachSession/requireAuth/requireRole). utils/auth.js is now a thin
  compat facade so existing imports are unchanged.

Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
  long-lived refresh token, stored hashed and rotated on use, in a new
  mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
  TOTP. token.signToken gains a backward-compatible expiresIn option.

Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
  OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
  discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
  identities are never auto-provisioned. Client secrets encrypted at rest
  (AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
  account linking (/admin/account/identities). New auth_providers +
  user_identities tables.

Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
  graceful with zero providers). New Authentication admin view
  (Local/Google/Discord/Custom). Account page linked-accounts section.

Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/auth/auth.controller.js

@@ -1,12 +1,7 @@
 const users = require('../../../model/users/users.model')
 const activity = require('../../../model/activity/activity.model')
-const {
-  signToken,
-  setAuthCookie,
-  clearAuthCookie,
-  signTotpChallenge,
-  verifyTotpChallenge,
-} = require('../../../utils/auth')
+const { setAuthCookie, clearAuthCookie } = require('../../../auth/token')
+const sessionService = require('../../../auth/session.service')
 const totp = require('../../../utils/totp')
 const botScore = require('../../../middleware/botScore')
 const loginProtection = require('../../../middleware/loginProtection')
@@ -26,15 +21,17 @@ function needsTotp(user) {
   return Boolean(user && user.totp_enabled)
 }
 
-// Issue the real session: sign the JWT, set the cookie, clear the IP's failure
-// backoff, and record the login.
-async function issueSession(req, res, user) {
+// Issue the real session: create the session token via the session service, set
+// the cookie, clear the IP's failure backoff, and record the login. authMethod
+// records how this session was authenticated ('local' password, or 'totp' after
+// the second factor) — carried in the session token for downstream visibility.
+async function issueSession(req, res, user, authMethod = 'local') {
   loginProtection.recordSuccess(req.ip)
   await users.recordLogin(user.id)
-  const token = signToken(user)
+  const { token } = sessionService.createSession(user, authMethod)
   setAuthCookie(req, res, token)
   await activity.log({ req, userId: user.id, action: 'auth.login' })
-  log.info('login success', { username: user.username, id: user.id, ip: req.ip })
+  log.info('login success', { username: user.username, id: user.id, ip: req.ip, authMethod })
   return res.json({ user: { id: user.id, username: user.username, role: user.role } })
 }
 
@@ -64,12 +61,12 @@ async function login(req, res) {
     // hand back a short-lived, signed "password verified" challenge and require
     // the code. If TOTP is off, log them straight in.
     if (needsTotp(user)) {
-      const challenge = signTotpChallenge(user)
+      const challenge = sessionService.createPartialSession(user)
       log.info('password ok, awaiting TOTP', { username: user.username, id: user.id, ip: req.ip })
       return res.json({ totpRequired: true, challenge })
     }
 
-    return issueSession(req, res, user)
+    return issueSession(req, res, user, 'local')
   } catch (err) {
     log.error('login error', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -80,7 +77,7 @@ async function login(req, res) {
 // session. A wrong code counts as a failed attempt (backoff + bot score).
 async function loginTotp(req, res) {
   const { challenge, code } = req.body
-  const decoded = verifyTotpChallenge(challenge)
+  const decoded = sessionService.upgradeSessionAfterTotp(challenge)
   if (!decoded) {
     return res.status(401).json({ message: 'Your verification session expired. Please sign in again.' })
   }
@@ -92,7 +89,7 @@ async function loginTotp(req, res) {
       log.warn('TOTP verify failed', { id: decoded.id, ip: req.ip })
       return res.status(401).json({ message: 'Invalid verification code.' })
     }
-    return issueSession(req, res, user)
+    return issueSession(req, res, user, 'totp')
   } catch (err) {
     log.error('loginTotp error', err)
     return res.status(500).json({ message: 'Internal Server Error' })