Add session abstraction, mobile bearer auth, and pluggable SSO

Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).

Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
  (create/validate/partial-TOTP/revoke), session.middleware.js
  (attachSession/requireAuth/requireRole). utils/auth.js is now a thin
  compat facade so existing imports are unchanged.

Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
  long-lived refresh token, stored hashed and rotated on use, in a new
  mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
  TOTP. token.signToken gains a backward-compatible expiresIn option.

Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
  OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
  discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
  identities are never auto-provisioned. Client secrets encrypted at rest
  (AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
  account linking (/admin/account/identities). New auth_providers +
  user_identities tables.

Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
  graceful with zero providers). New Authentication admin view
  (Local/Google/Discord/Custom). Account page linked-accounts section.

Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/test/ssoState.test.js

@@ -0,0 +1,38 @@
+process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret'
+
+const { test } = require('node:test')
+const assert = require('node:assert/strict')
+const crypto = require('crypto')
+
+const ssoState = require('../src/auth/ssoState')
+
+test('createTx → verifyTx round-trips the flow payload', () => {
+  const tx = ssoState.createTx({ provider: 'google', mode: 'login', returnTo: '/admin/posts' })
+  assert.ok(tx.nonce && tx.verifier && tx.codeChallenge && tx.txToken)
+
+  const payload = ssoState.verifyTx(tx.txToken, tx.nonce)
+  assert.ok(payload)
+  assert.equal(payload.provider, 'google')
+  assert.equal(payload.mode, 'login')
+  assert.equal(payload.returnTo, '/admin/posts')
+  assert.equal(payload.verifier, tx.verifier)
+})
+
+test('codeChallenge is the S256 hash of the verifier', () => {
+  const tx = ssoState.createTx({ provider: 'discord', mode: 'login' })
+  const expected = crypto.createHash('sha256').update(tx.verifier).digest('base64url')
+  assert.equal(tx.codeChallenge, expected)
+})
+
+test('verifyTx rejects a mismatched / tampered nonce', () => {
+  const tx = ssoState.createTx({ provider: 'google', mode: 'login' })
+  assert.equal(ssoState.verifyTx(tx.txToken, 'wrong-nonce'), null)
+  assert.equal(ssoState.verifyTx(tx.txToken, null), null)
+  assert.equal(ssoState.verifyTx(null, tx.nonce), null)
+})
+
+test('verifyTx rejects a non-tx token', () => {
+  const token = require('../src/auth/token')
+  const notTx = token.signToken({ id: 1, username: 'a', role: 'admin' })
+  assert.equal(ssoState.verifyTx(notTx, 'anything'), null)
+})