feat: authentication with local accounts, sessions, CSRF, RBAC, and OIDC PKCE (phase 3)

- argon2id (t=3, m=64MiB, p=2) PHC hashing honoring embedded params
- token-bucket rate limiting (10/15min per IP+email) on login/register
- opaque 32B session tokens in Mongo, 30-day sliding expiry, logout-all
- CSRF double-submit cookie/header on authenticated mutations
- bootstrap admin from env with forced first-login password change
- requireAuth/requireRole middleware with disabled-account enforcement
- OIDC code flow with PKCE: lazy discovery, account linking only on
  verified email, auto-created developer accounts
- unit tests (RBAC matrix, CSRF, password, rate limiter) + integration
  suite covering the full auth matrix incl. an in-test fake IdP

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/server.go

@@ -8,34 +8,43 @@ import (
 	"net/http"
 	"time"
 
+	"bountyboard/internal/auth"
 	"bountyboard/internal/config"
 	"bountyboard/internal/metrics"
+	"bountyboard/internal/store"
 )
 
 // shutdownBudget is the §12 graceful-shutdown drain window.
 const shutdownBudget = 15 * time.Second
 
 type Server struct {
-	cfg       *config.Config
-	log       *slog.Logger
-	metrics   *metrics.Registry
-	checks    []ReadinessCheck
-	startedAt time.Time
-	httpSrv   *http.Server
+	cfg          *config.Config
+	log          *slog.Logger
+	metrics      *metrics.Registry
+	store        *store.Store
+	oidc         *auth.OIDCClient
+	loginLimiter *auth.RateLimiter
+	checks       []ReadinessCheck
+	startedAt    time.Time
+	httpSrv      *http.Server
 }
 
-func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry) *Server {
+func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.Store) *Server {
 	s := &Server{
-		cfg:       cfg,
-		log:       log,
-		metrics:   reg,
-		startedAt: time.Now(),
+		cfg:          cfg,
+		log:          log,
+		metrics:      reg,
+		store:        st,
+		oidc:         auth.NewOIDCClient(cfg, log),
+		loginLimiter: auth.NewRateLimiter(10, 15*time.Minute),
+		startedAt:    time.Now(),
 	}
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", s.handleHealthz)
 	mux.HandleFunc("GET /readyz", s.handleReadyz)
 	mux.HandleFunc("GET /metricsz", s.handleMetricsz)
+	s.routesAuth(mux)
 
 	s.httpSrv = &http.Server{
 		Addr:              fmt.Sprintf(":%d", cfg.AppPort),