feat(auth): external sign-in for the website and admin panel

Players sign in to the website, and admins to the admin panel, with an
OpenID Connect provider (DorkNet:SignIn:*). The first sign-in links the
provider identity (issuer + subject) to a DorkNet account with that
account's password; after that the provider sign-in is enough.

- Cookie sessions per host, keys persisted in the database so redeploys
  keep people signed in; unlink, deletion or a ban ends the session.
- Link attempts limited to 5 failures per 15 minutes per identity and
  per username.
- Admin panel: "Sign in with ..." exchanges the session for the usual
  admin tokens via GET /api/admin/v1/sso (IsAdmin still required).
- Downloads: optional DorkNet:Downloads:RequireSignIn serves the
  manifest and files only to signed-in players; the Downloads and Quest
  pages offer sign-in instead.
- Website: sign-in in the header, /link and /account pages.

The game client's login is unchanged.

DorkNet.Server/site/src/lib/downloads.ts

@@ -28,6 +28,12 @@ export interface DownloadsManifest {
   updated?: string;
 }
 
+/** The server only serves downloads to signed-in players
+ * (DorkNet:Downloads:RequireSignIn) and nobody is signed in. */
+export class SignInRequiredError extends Error {
+  constructor() { super('sign_in_required'); this.name = 'SignInRequiredError'; }
+}
+
 let cached: Promise<DownloadsManifest | null> | null = null;
 
 /** The manifest, or null when this server doesn't offer downloads. Fetched
@@ -36,6 +42,7 @@ export function getDownloads(fresh = false): Promise<DownloadsManifest | null> {
   if (!cached || fresh) {
     cached = get<DownloadsManifest>('/downloads').catch((e) => {
       if (e instanceof ApiError && e.status === 404) return null;
+      if (e instanceof ApiError && e.status === 401) { cached = null; throw new SignInRequiredError(); }
       cached = null;
       throw e;
     });