feat: optional user accounts (part A: foundation) (#2129)

Part A of #2128: optional, off-by-default user accounts. With the
feature off nothing changes; with it on, visitors can register and log
in, and admins manage users and use the operator actions without the API
key.

PR #2130 (settings sync) builds on this one. The two are meant to be
merged together.

## The situation

- Operator actions (geofilter save and prune, backup, perf reset) need
the shared `apiKey`. There is no per-person right.
- Nothing in CoreScope knows who a visitor is, so the requests in #2128
that need that (#1835, #2092, #1508, #730) have nothing to build on.

## What this PR adds

**Two new Go modules**
- `internal/users`: a separate `users.db` (SQLite through
`modernc.org/sqlite`) with users, sessions, single-use tokens, an audit
log and a mail log. Passwords use argon2id.
- `internal/mailer`: a `Mailer` interface with a Brevo client (send,
delivery events, webhook parsing) and an in-memory fake for tests.

**Server (`cmd/server`)**, active only with `userManagement.enabled`
- 24 routes, all documented in OpenAPI under the `users` tag
([`auth_routes.go`](https://github.com/efiten/CoreScope/blob/feat/user-management/cmd/server/auth_routes.go)):
  - auth: register, activate, login, logout, me, forgot, reset;
- account: profile, password, email change with confirmation, sessions,
self-delete;
- admin: list, detail, disable, enable, delete, role, resend activation,
manual activation, mail status refresh;
  - a Brevo webhook, registered only when `mail.webhookSecret` is set.
- `requireAdmin` replaces `requireAPIKey` at the 7 operator call sites:
the API key **or** an admin session. With the feature off it is the old
API-key gate (`TestRequireAdminWithoutUserManagementIsAPIKeyGate`).
- `/api/config/client` gets `userManagement: {enabled: true}` only when
the service started; with the feature off the response is
byte-identical.

**Frontend**
- `auth.js` (header account control, request helper that adds the CSRF
header), `account.js` (login, register, activate, forgot, reset, confirm
email, my account), `admin-users.js` (`#/admin/users`, deep-linked
filters), `account.css` (theme tokens only).
- On phones the top-bar control is hidden, so a conditional entry goes
into the bottom-nav "More" sheet and the nav drawer.
- The customizer geofilter tab and the Perf "Reset stats" button use the
admin session when there is one.

**Config.** A `userManagement` block (`config.example.json`,
[`docs/user-guide/accounts.md`](https://github.com/efiten/CoreScope/blob/feat/user-management/docs/user-guide/accounts.md)).
The Brevo key can come from `CORESCOPE_BREVO_API_KEY`. The server
refuses to start when the block is enabled but incomplete.

## Security choices

- Session cookie `cs_session`: HttpOnly, SameSite=Lax, Secure when
`publicBaseUrl` is https. Every cookie-authenticated state change needs
the `X-CS-CSRF` header and a matching Origin.
- Activation needs the token **and** the account password. Without the
password, an attacker who keeps re-registering a known address could get
the owner to activate an account that carries the attacker's password.
- Register, forgot and email change answer identically for known and
unknown addresses. A password reset ends all sessions, a password change
ends all other sessions, and both end outstanding email-change links.
- Rate limits: login 10 per 15 minutes, register and forgot 5 per hour,
per IP and per address. The bucket count is capped. `trustedProxies`
makes the per-IP limits see real client IPs behind a proxy.
- Server logs carry `#<user id>`, never addresses, tokens or passwords;
mail-provider error texts are redacted before logging.

## Performance

No change to an existing hot path with the feature off. With it on:
- One `users.db` lookup per authenticated request (session by token
hash).
- The admin user table rebuilds its `tbody` on each filter change.
`users.List` caps the result at 1000 rows (`internal/users/users.go`),
which bounds the rebuild.
- `map[string]interface{}` in `openapi.go`: 79 before, 78 after.

## Verification

- `internal/users`, `internal/mailer` and `cmd/server`: `go vet` and `go
test -race` pass locally. 121 new Go tests.
- `cmd/server` with `-tags e2etest`: vet and the e2e hook tests pass.
- `sh test-all.sh` exits 0. `tests/unit/test-user-management-ui.js`: 67
passing (vm, real modules).
- `tests/e2e/test-user-management-e2e.js` (6 steps) passed locally
against an `e2etest` build with the fake mailer and against a
feature-off build. CI builds the `e2etest` binary and runs the suite on
a second server (`deploy.yml`).
- On a staging instance with a real Brevo key: register, activation mail
delivered, activate, admin table, "Refresh status" showing sent,
deferred, delivered, opened and clicked.

## Not in this PR

- Settings sync (#2130), the admin dashboard, approval flows and
notifications (parts B to E of #2128).
- A `requireReadAuth` mode (#1835). Sessions from this PR are what such
a mode would accept.
- Binary size and build time with `modernc.org/sqlite` linked next to
`mattn/go-sqlite3` were not measured. Their driver names do not collide.
#1992 discusses the driver choice.
- No Brevo webhook was configured on staging; delivery status there came
from "Refresh status".

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -188,6 +188,8 @@ jobs:
           # -race gates PR #1208's atomic.Pointer migration: the race-detector
           # is what makes path_inspect_atomic_race_test.go actually assert.
           go test -timeout 20m -race -coverprofile=server-coverage.out ./... 2>&1 | tee server-test.log
+          # The e2etest build (fake mailer + /__e2e/last-mail) has its own tests.
+          go test -tags e2etest -count=1 -run 'E2E' .
           echo "--- Go Server Coverage ---"
           go tool cover -func=server-coverage.out | tail -1
 
@@ -211,6 +213,13 @@ jobs:
           go test ./...
           echo "--- Decrypt CLI tests passed ---"
 
+      - name: Test user-management modules (users, mailer)
+        run: |
+          set -e -o pipefail
+          cd internal/users && go test -race ./...
+          cd ../mailer && go test -race ./...
+          echo "--- users + mailer tests passed ---"
+
       - name: Test migrate CLI + dbschema
         run: |
           set -e -o pipefail
@@ -352,6 +361,7 @@ jobs:
         run: |
           cd cmd/server
           go build -o ../../corescope-server .
+          go build -tags e2etest -o ../../corescope-server-e2e .
           echo "Go server built successfully"
 
       - name: Build Go migrate tool
@@ -476,6 +486,33 @@ jobs:
             sleep 1
           done
 
+      - name: Start user-management E2E server (fake mailer)
+        run: |
+          fuser -k 13582/tcp 2>/dev/null || true
+          rm -rf /tmp/cs-um
+          mkdir -p /tmp/cs-um
+          # Own copy of the (already migrated and seeded) fixture; fresh users.db every run.
+          cp test-fixtures/e2e-fixture.db /tmp/cs-um/on.db
+          cat > /tmp/cs-um/config.json <<'JSON'
+          {
+            "port": 13582,
+            "userManagement": {
+              "enabled": true,
+              "dbPath": "/tmp/cs-um/users.db",
+              "adminEmails": ["admin@e2e.test"],
+              "publicBaseUrl": "http://localhost:13582",
+              "mail": { "provider": "fake", "fromEmail": "noreply@e2e.test" }
+            }
+          }
+          JSON
+          ./corescope-server-e2e -config-dir /tmp/cs-um -port 13582 -db /tmp/cs-um/on.db -public public-instrumented &
+          echo $! > .server-um.pid
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:13582/api/healthz > /dev/null 2>&1; then echo "UM server ready after ${i}s"; break; fi
+            if [ "$i" -eq 30 ]; then echo "UM server failed to start within 30s"; exit 1; fi
+            sleep 1
+          done
+
       - name: Run Playwright E2E tests (fail-fast)
         run: |
           echo "=== E2E SUITE: test-e2e-playwright.js ==="
@@ -728,6 +765,8 @@ jobs:
           BASE_URL=http://localhost:13581 node tests/e2e/test-nodes-export-e2e.js 2>&1 | tee -a e2e-output.txt
           echo "=== E2E SUITE: test-show-neighbors.js ==="
           BASE_URL=http://localhost:13581 node tests/e2e/test-show-neighbors.js 2>&1 | tee -a e2e-output.txt
+          echo "=== E2E SUITE: test-user-management-e2e.js ==="
+          BASE_URL=http://localhost:13582 BASE_URL_OFF=http://localhost:13581 node tests/e2e/test-user-management-e2e.js 2>&1 | tee -a e2e-output.txt
 
       # #1616: slide-over focus-restore flake-gate. Runs the slide-over
       # E2E 20 consecutive times against the SAME backend instance so
@@ -793,6 +832,10 @@ jobs:
             kill $(cat .server.pid) 2>/dev/null || true
             rm -f .server.pid
           fi
+          if [ -f .server-um.pid ]; then
+            kill $(cat .server-um.pid) 2>/dev/null || true
+            rm -f .server-um.pid
+          fi
 
       - name: Upload E2E badges
         if: success()