feat: authentication with local accounts, sessions, CSRF, RBAC, and OIDC PKCE (phase 3)

- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params
- token-bucket rate limiting (10/15min per IP+email) on login/register
- opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all
- CSRF double-submit cookie/header on authenticated mutations
- bootstrap admin from env with forced first-login password change
- requireAuth/requireRole middleware with disabled-account enforcement
- OIDC code flow with PKCE: lazy discovery, account linking only on
  verified email, auto-created developer accounts
- unit tests (RBAC matrix, CSRF, password, rate limiter) + integration
  suite covering the full auth matrix incl. an in-test fake IdP

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/app/main.go

@@ -10,6 +10,7 @@ import (
 	"syscall"
 	"time"
 
+	"bountyboard/internal/auth"
 	"bountyboard/internal/config"
 	httpx "bountyboard/internal/http"
 	"bountyboard/internal/metrics"
@@ -50,8 +51,12 @@ func run() error {
 		}
 	}()
 
+	if err := auth.EnsureBootstrapAdmin(ctx, st, cfg, log); err != nil {
+		return err
+	}
+
 	reg := metrics.NewRegistry()
-	srv := httpx.New(cfg, log, reg)
+	srv := httpx.New(cfg, log, reg, st)
 	srv.AddReadinessCheck(httpx.ReadinessCheck{
 		Name:     "mongo",
 		Required: true,