feat(backend): Discord OAuth login with DB-backed sessions (#23)

The browser UI signs in with a Discord authorization code grant
(identify + guilds.members.read) instead of a shared password. Guild
membership is the gate; the owner's Discord ID is the only identity
allowed in while registration is closed. Sessions become rows in a
sessions table with opaque random ids — the cookie carries only the id,
looked up and expiry-checked per request — so deleting a row revokes a
session. HMAC cookie signing, its derived key, and WEB_PASSWORD are
gone, and no replacement signing secret is introduced (ADR-0002).

Discord's API base is configurable (DISCORD_API_BASE); the full flow is
tested through the real router against a local stub, including the
form-encoded token exchange Discord rejects if sent as JSON.

backend/internal/web/templates/login.html

@@ -19,17 +19,13 @@
     <figure class="login-art" aria-hidden="true">
       <img src="/static/login-art.png" alt="">
     </figure>
-    <form method="post" action="/login">
-      <div>
-        <label for="password">Password</label>
-        <input id="password" name="password" type="password"
-               autocomplete="current-password" autofocus required>
-      </div>
+    <form method="get" action="/auth/discord">
       {{/* The page reloads on a failed sign-in, so the message is present from
            the start; role=alert is what gets it announced anyway. */}}
       <p class="error" role="alert">{{.Error}}</p>
-      <button type="submit">Sign in</button>
+      <button type="submit">Continue with Discord</button>
     </form>
+    <p class="login-note">Guild membership is required to sign in.</p>
   </main>
 </body>
 </html>