feat(auth): external sign-in for the website and admin panel

Players sign in to the website, and admins to the admin panel, with an
OpenID Connect provider (DorkNet:SignIn:*). The first sign-in links the
provider identity (issuer + subject) to a DorkNet account with that
account's password; after that the provider sign-in is enough.

- Cookie sessions per host, keys persisted in the database so redeploys
  keep people signed in; unlink, deletion or a ban ends the session.
- Link attempts limited to 5 failures per 15 minutes per identity and
  per username.
- Admin panel: "Sign in with ..." exchanges the session for the usual
  admin tokens via GET /api/admin/v1/sso (IsAdmin still required).
- Downloads: optional DorkNet:Downloads:RequireSignIn serves the
  manifest and files only to signed-in players; the Downloads and Quest
  pages offer sign-in instead.
- Website: sign-in in the header, /link and /account pages.

The game client's login is unchanged.

DorkNet.Server/Services/DownloadsService.cs

@@ -39,6 +39,7 @@ public sealed class DownloadsService
         }
         var host = config["DorkNet:Downloads:Host"]?.Trim();
         _host = string.IsNullOrEmpty(host) ? null : host;
+        RequireSignIn = config.GetValue<bool>("DorkNet:Downloads:RequireSignIn");
 
         if (_baseUri is null)
             log.LogInformation("[downloads] no DorkNet:Downloads:BaseUrl; the Downloads page and Quest latest-build install are off");
@@ -48,6 +49,10 @@ public sealed class DownloadsService
 
     public bool IsConfigured => _baseUri is not null;
 
+    /// <summary><c>DorkNet:Downloads:RequireSignIn</c>: serve the manifest and
+    /// files only to a signed-in, linked player (website sign-in).</summary>
+    public bool RequireSignIn { get; }
+
     /// <summary>The published manifest, or null when none has been published yet.</summary>
     public async Task<JsonObject?> GetManifestAsync(CancellationToken ct)
     {