Add optional global authentication

[zR-JB]

Summary

• add opt-in password, OIDC, and hybrid authentication across every listener
• add bounded memory-only sessions, CSRF/origin enforcement, cancellation, and browser approval for native-client bearer grants
• add a generated no-JavaScript login surface sourced from client/src/auth, plus a loopback preview command
• add authenticated browser teardown, account controls, and native TUI authorization
• document only the required configuration and reverse-proxy settings

Why

Public deployments currently allow unauthenticated callers to invoke measurement-scale workloads. This adds one Go-owned security boundary while preserving existing behavior when authentication is disabled.

Verification

• full race-enabled Go suite
• Go vet, module verification, CGO-free builds, and formatting
• 271 client unit tests, Svelte/TypeScript checks, formatting, and production build
• Chromium and Firefox Playwright suite
• password and OIDC parser fuzzing
• real H1, H2, H3, and WebSocket rejection tests
• production container build and smoke check
• repeated parallel adversarial reviews

The PR remains a draft while the latest GitHub checks complete.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 620a05f710

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".