feat(auth): external sign-in for the website and admin panel

Players sign in to the website, and admins to the admin panel, with an
OpenID Connect provider (DorkNet:SignIn:*). The first sign-in links the
provider identity (issuer + subject) to a DorkNet account with that
account's password; after that the provider sign-in is enough.

- Cookie sessions per host, keys persisted in the database so redeploys
  keep people signed in; unlink, deletion or a ban ends the session.
- Link attempts limited to 5 failures per 15 minutes per identity and
  per username.
- Admin panel: "Sign in with ..." exchanges the session for the usual
  admin tokens via GET /api/admin/v1/sso (IsAdmin still required).
- Downloads: optional DorkNet:Downloads:RequireSignIn serves the
  manifest and files only to signed-in players; the Downloads and Quest
  pages offer sign-in instead.
- Website: sign-in in the header, /link and /account pages.

The game client's login is unchanged.

docs/admin.md

@@ -41,6 +41,13 @@ there is always a bootstrap operator. The login form posts to
 | `dorknet.admin.token` | DorkNet admin JWT |
 | `dorknet.admin.me` | Admin identity object used by the layout |
 
+With [external sign-in](deploy.md#external-sign-in-openid-connect)
+configured, the login page also shows **Sign in with …**. It signs in with
+the provider on the admin host, then `GET /api/admin/v1/sso` swaps that
+session for the same token pair the password login returns. The identity
+must already be linked to an account on the website, and the account still
+needs `IsAdmin = true`.
+
 Every admin API request sends `Authorization: Bearer <token>`. Protected
 actions are guarded by `AdminOnlyAttribute`, which checks the resolved
 player row still has `IsAdmin = true`. A `401` clears the local session