feat(auth): sign in with Steam (MODULE_API 1.17.0)

Steam is a built-in provider beside Google and Discord (STEAM_SIGNIN.md,
D392-D396). OpenID 2.0: the assertion is verified server to server with
check_authentication, return_to must match byte for byte, and the claimed id
must be a 17-digit SteamID64. A Steam Web API key is required to enable it
(D394); persona name and avatar are stored on the identity and refreshed at
each sign-in, and a failed lookup never blocks one. Steam never signs anybody
up (D395), on the web or the mobile bridge. Several Steam accounts may be
linked; DELETE /auth/me/account/identities/:provider takes ?id= to unlink one.

MODULE_API 1.17.0: ctx.identities.list, api.onIdentityLinking (refuse-only,
fails closed, module text never shown) and api.onIdentityLinked. No unlink
hook (D393). Schema additive; OpenAPI, routes and engagement manifests
regenerated with no modules installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/moduleLoader.test.js

@@ -519,8 +519,11 @@ test('ctx exposes exactly the documented surface, and is frozen', () => {
   // throws until Phase 7 builds the channel — which is why it has to be in this
   // list now: a member of a declared version that were absent would make
   // MODULE_API_VERSION a lie, and this test is what says so.
+  // API 1.17.0 added `identities` (STEAM_SIGNIN.md §4): READ only, one provider
+  // at a time. Linking stays core's, and a module takes part through the two
+  // hooks on `api`, never by writing an identity itself.
   assert.deepEqual(probe.keys, [
-    'activity', 'auth', 'db', 'events', 'express', 'inbox', 'log', 'middleware', 'moduleId', 'paths',
+    'activity', 'auth', 'db', 'events', 'express', 'identities', 'inbox', 'log', 'middleware', 'moduleId', 'paths',
     'posts', 'push', 'secretBox', 'settings', 'site', 'teams', 'uploads', 'users', 'validator',
   ])
   //  is core's limiter FACTORY, not a limiter: a module states its own