Add local auth: users, sessions, register/login/logout/me (#4)

Implements pansy's local (email + password) authentication and the
session layer that OIDC (#5) will also reuse.

- store: users.go (create/get-by-id/get-by-email/count) and sessions.go
  (create/get/touch/delete/delete-expired), scanning the existing 0001
  schema.
- service: the business-logic seam. auth.go (Register/Login/session
  lifecycle/Providers) + password.go (argon2id, 64 MiB/1/4, PHC-encoded,
  constant-time verify) + service.go (Service, clock injection, token
  hashing). First user is admin; closed registration still allows the
  bootstrap user; unknown-email and wrong-password are indistinguishable
  (same error, same argon2 work via a dummy hash).
- api: POST /auth/register|login|logout, GET /auth/me|providers, plus a
  requireAuth middleware that resolves the HttpOnly session cookie
  (SameSite=Lax, Secure under https) to the actor. Handlers stay thin.
- main: wires the service and a periodic expired-session sweep; sessions
  are also dropped lazily on access. Sliding 30-day expiry.
- tests: service (register/login/expiry/renewal/cleanup, password) and
  api (cookie flow, middleware, validation, providers).

Verified end-to-end via curl: register -> me -> restart -> session
persists -> logout -> 401.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

cmd/pansy/main.go

@@ -16,10 +16,15 @@ import (
 
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/api"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/service"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/store"
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/webdist"
 )
 
+// sessionSweepInterval is how often expired sessions are purged in the
+// background (they are also dropped lazily on access).
+const sessionSweepInterval = 6 * time.Hour
+
 func main() {
 	slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo})))
 
@@ -47,7 +52,9 @@ func run() error {
 	}
 	slog.Info("pansy: database ready", "path", cfg.DBPath)
 
-	r := api.New(cfg)
+	svc := service.New(db, cfg)
+
+	r := api.New(cfg, svc)
 	api.RegisterSPA(r, webdist.Dist())
 
 	srv := &http.Server{
@@ -71,6 +78,8 @@ func run() error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
+	go sweepSessions(ctx, svc)
+
 	select {
 	case err := <-serveErr:
 		return fmt.Errorf("http server: %w", err)
@@ -85,3 +94,25 @@ func run() error {
 	}
 	return nil
 }
+
+// sweepSessions periodically purges expired sessions until ctx is cancelled. It
+// runs one sweep immediately so a long-lived process doesn't wait a full
+// interval after startup. Failures are logged, never fatal.
+func sweepSessions(ctx context.Context, svc *service.Service) {
+	ticker := time.NewTicker(sessionSweepInterval)
+	defer ticker.Stop()
+	for {
+		if n, err := svc.CleanupExpiredSessions(ctx); err != nil {
+			if ctx.Err() == nil {
+				slog.Warn("pansy: session sweep failed", "error", err)
+			}
+		} else if n > 0 {
+			slog.Info("pansy: purged expired sessions", "count", n)
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+	}
+}