feat(backend): Discord OAuth login with DB-backed sessions (#23) (#31)

Implements #23 per ADR-0002.

- Discord authorization code grant (identify + guilds.members.read), form-encoded token exchange
- Guild membership gate via the single-guild endpoint; optional DISCORD_REQUIRED_ROLE (empty default)
- Owner Discord ID is the only identity allowed to sign in
- Sessions are DB rows with opaque random ids; cookie carries only the id; expiry enforced; delete = revoke
- HMAC session signing, derived key, and WEB_PASSWORD removed; no replacement signing secret
- Login rate limiting preserved on the callback
- Full flow tested through the real router against a local Discord stub (DISCORD_API_BASE)
- Env: DISCORD_CLIENT_ID/_CLIENT_SECRET/_GUILD_ID/_REQUIRED_ROLE/_API_BASE/_REDIRECT_URI; docs updated

go test ./... passes.

Reviewed-on: #31
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/main.go

@@ -29,11 +29,12 @@ type Config struct {
 	// because a wrong guess would silently start on an empty database.
 	DatabaseURL string
 	Port        string
-	// WebPassword gates the browser UI. Empty disables the web routes entirely.
-	WebPassword string
 	// OwnerDiscordID identifies the seeded owner Reader (issue #22). Required:
 	// bookmarks are scoped to a Reader, and without an owner there is none.
+	// It is also the only Discord identity allowed to sign in (issue #23).
 	OwnerDiscordID string
+	// Discord is the OAuth application the browser UI signs in with.
+	Discord web.DiscordConfig
 	// UserscriptPath is the file served at /u/{token}/manga-bookmark.user.js.
 	// Supplied by a bindmount so the script can be edited without a rebuild.
 	UserscriptPath string
@@ -151,12 +152,20 @@ func loadConfig() Config {
 		Token:               os.Getenv("API_TOKEN"),
 		DatabaseURL:         os.Getenv("DATABASE_URL"),
 		Port:                envOr("PORT", "8080"),
-		WebPassword:         os.Getenv("WEB_PASSWORD"),
 		OwnerDiscordID:      os.Getenv("OWNER_DISCORD_ID"),
 		UserscriptPath:      envOr("USERSCRIPT_PATH", "/userscript/manga-bookmark.user.js"),
 		NovelUserscriptPath: envOr("NOVEL_USERSCRIPT_PATH", "/userscript/novel-bookmark.user.js"),
 		LatestPoll:          loadLatestPoll(),
 	}
+	c.Discord = web.DiscordConfig{
+		ClientID:       os.Getenv("DISCORD_CLIENT_ID"),
+		ClientSecret:   os.Getenv("DISCORD_CLIENT_SECRET"),
+		GuildID:        os.Getenv("DISCORD_GUILD_ID"),
+		RequiredRole:   os.Getenv("DISCORD_REQUIRED_ROLE"),
+		APIBase:        envOr("DISCORD_API_BASE", "https://discord.com/api/v10"),
+		RedirectURI:    os.Getenv("DISCORD_REDIRECT_URI"),
+		OwnerDiscordID: c.OwnerDiscordID,
+	}
 	for _, o := range strings.Split(os.Getenv("ALLOWED_ORIGINS"), ",") {
 		if o = strings.TrimSpace(o); o != "" {
 			c.AllowedOrigins = append(c.AllowedOrigins, o)
@@ -173,8 +182,8 @@ func newRouter(s *store.Store, cfg Config) http.Handler {
 	mux.HandleFunc("GET /healthz", api.Healthz)
 
 	// Outside httpmw.Auth (the updater sends no Authorization header) and
-	// outside the WEB_PASSWORD gate (the script must be installable either
-	// way). The path segment carries the token instead.
+	// outside the web UI's Discord auth (the script must be installable
+	// without a browser session). The path segment carries the token instead.
 	mux.HandleFunc("GET /u/{token}/manga-bookmark.user.js", userscript.Handler(cfg.Token, cfg.UserscriptPath))
 	mux.HandleFunc("GET /u/{token}/novel-bookmark.user.js", userscript.Handler(cfg.Token, cfg.NovelUserscriptPath))
 
@@ -188,16 +197,13 @@ func newRouter(s *store.Store, cfg Config) http.Handler {
 	mux.Handle("/bookmarks", auth)
 	mux.Handle("/bookmarks/", auth)
 
-	// The browser UI is registered only when a password is configured, so a
-	// deployment that forgets WEB_PASSWORD exposes nothing rather than
-	// exposing an unprotected list.
-	if cfg.WebPassword != "" {
-		wh, err := web.New(s, s.OwnerID(), cfg.Token, cfg.WebPassword)
-		if err != nil {
-			log.Fatalf("web handler: %v", err)
-		}
-		wh.Register(mux)
+	// The browser UI is always registered; signing in is Discord OAuth, so
+	// there is no password to forget and no gate to leave unset.
+	wh, err := web.New(s, s.OwnerID(), cfg.Discord)
+	if err != nil {
+		log.Fatalf("web handler: %v", err)
 	}
+	wh.Register(mux)
 
 	return httpmw.CORS(cfg.AllowedOrigins, httpmw.Gzip(guardEmptyUserscriptToken(mux)))
 }
@@ -228,6 +234,18 @@ func main() {
 	if cfg.DatabaseURL == "" {
 		log.Fatal("DATABASE_URL is required")
 	}
+	// The web UI signs in through Discord, so a deployment without the OAuth
+	// application is misconfigured rather than passwordless.
+	for key, v := range map[string]string{
+		"DISCORD_CLIENT_ID":     cfg.Discord.ClientID,
+		"DISCORD_CLIENT_SECRET": cfg.Discord.ClientSecret,
+		"DISCORD_GUILD_ID":      cfg.Discord.GuildID,
+		"DISCORD_REDIRECT_URI":  cfg.Discord.RedirectURI,
+	} {
+		if v == "" {
+			log.Fatalf("%s is required", key)
+		}
+	}
 
 	// The owner's userscript token is the global API token today (issue #22);
 	// the readers row carries its SHA-256, not the token itself.