Add session abstraction, mobile bearer auth, and pluggable SSO

Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).

Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
  (create/validate/partial-TOTP/revoke), session.middleware.js
  (attachSession/requireAuth/requireRole). utils/auth.js is now a thin
  compat facade so existing imports are unchanged.

Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
  long-lived refresh token, stored hashed and rotated on use, in a new
  mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
  TOTP. token.signToken gains a backward-compatible expiresIn option.

Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
  OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
  discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
  identities are never auto-provisioned. Client secrets encrypted at rest
  (AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
  account linking (/admin/account/identities). New auth_providers +
  user_identities tables.

Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
  graceful with zero providers). New Authentication admin view
  (Local/Google/Discord/Custom). Account page linked-accounts section.

Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/auth/mobile.routes.js

@@ -0,0 +1,48 @@
+const express = require('express')
+const { body } = require('express-validator')
+
+const { login, refresh, logout } = require('./mobile.controller')
+const { requireAuth } = require('../../../auth/session.middleware')
+const { loginLimiter, mobileRefreshLimiter } = require('../../../middleware/rateLimit')
+const { slowLogin, backoffGuard } = require('../../../middleware/loginProtection')
+const validate = require('../../../middleware/validate')
+
+const mobileRouter = express.Router()
+
+// Mobile login is a credential surface too, so it sits behind the SAME guards as
+// web login (cheapest rejection first): per-IP backoff → progressive slowdown →
+// hard rate cap.
+const loginGuards = [backoffGuard, slowLogin, loginLimiter]
+
+// POST /auth/mobile/login — { username, password, code? }
+mobileRouter.post(
+  '/login',
+  ...loginGuards,
+  body('username').isString().trim().notEmpty(),
+  body('password').isString().notEmpty(),
+  // Optional TOTP code (single-request 2FA); only checked when the account has 2FA on.
+  body('code').optional().isString().trim().isLength({ min: 6, max: 8 }),
+  validate,
+  login,
+)
+
+// POST /auth/mobile/refresh — { refreshToken }
+mobileRouter.post(
+  '/refresh',
+  mobileRefreshLimiter,
+  body('refreshToken').isString().notEmpty(),
+  validate,
+  refresh,
+)
+
+// POST /auth/mobile/logout — { refreshToken?, all? } — requires a valid bearer.
+mobileRouter.post(
+  '/logout',
+  requireAuth,
+  body('refreshToken').optional().isString(),
+  body('all').optional().isBoolean(),
+  validate,
+  logout,
+)
+
+module.exports = mobileRouter