feat(auth): external sign-in for the website and admin panel

Players sign in to the website, and admins to the admin panel, with an
OpenID Connect provider (DorkNet:SignIn:*). The first sign-in links the
provider identity (issuer + subject) to a DorkNet account with that
account's password; after that the provider sign-in is enough.

- Cookie sessions per host, keys persisted in the database so redeploys
  keep people signed in; unlink, deletion or a ban ends the session.
- Link attempts limited to 5 failures per 15 minutes per identity and
  per username.
- Admin panel: "Sign in with ..." exchanges the session for the usual
  admin tokens via GET /api/admin/v1/sso (IsAdmin still required).
- Downloads: optional DorkNet:Downloads:RequireSignIn serves the
  manifest and files only to signed-in players; the Downloads and Quest
  pages offer sign-in instead.
- Website: sign-in in the header, /link and /account pages.

The game client's login is unchanged.

README.md

@@ -431,6 +431,16 @@ hand it to the player, and they redeem it on the site's **`/join`** page —
 which creates their account bound to the device their game client
 reported, so the next launch logs straight in.
 
+### Website and admin sign-in
+
+Optionally, players sign in to the website (and admins to the admin panel)
+with an OpenID Connect provider such as a Cloudflare Access SaaS app. Each
+player links the provider identity to their DorkNet account once, with the
+account's password, on the site's **`/link`** page; the Quest page's direct
+install and the Downloads page can then be limited to signed-in players. The
+game client's login is unchanged. Setup:
+[`docs/deploy.md`](docs/deploy.md#external-sign-in-openid-connect).
+
 ### Everyone-is-friends toggle
 
 For small servers where searching + friend-requesting each other is