Add isolated local password authentication

[jzhao234]

TLDR

Explorer can now select either the existing external magic-link verifier or a deployment-local username/password provider. Local mode uses Argon2id credentials, revocable opaque sessions, secure host-only cookies, and operator-assisted account recovery without changing existing external-auth deployments.

Motivation

Some Explorer installations need accounts isolated from the surrounding application fleet while keeping one consistent, reviewable authentication implementation. Previously, Explorer could only consume the external magic-link cookie.

Fix

• Add a versioned SQLite account/session store with Argon2id hashing, random 256-bit opaque session tokens, 60-minute idle and 12-hour absolute expiration, rate limits, audit events, and immediate revocation.
• Add local login, mandatory temporary-password replacement, CSRF-protected password change/logout, fixed post-login destinations, generic login errors, and a deny-by-default route gate.
• Prompt for admin-supplied temporary passwords through hidden terminal input and never print or write them.
• Preserve the external Ed25519 magic-link provider as the default for existing deployments and keep provider cookies isolated.
• Add operator user lifecycle commands, protected systemd state storage, bootstrap/update support, and database backup/restore guidance.
• Require HTTPS for the host-only __Host-explorer_session cookie and fail local startup with an empty/default session secret.

Tests

• 91 passed — .venv/bin/python -m pytest -q
• All checks passed — .venv/bin/ruff check app tests
• 16 files already formatted — .venv/bin/ruff format --check app tests
• Passed — bash -n deploy/explorer-cli scripts/bootstrap.sh scripts/update.sh scripts/provision.sh
• Passed — git diff --check
• No leaks found — gitleaks git --staged --redact --no-banner .
• Fresh environment used the current pinned FastAPI, Starlette, cryptography, and Argon2 dependencies.

Checklist

• ruff check app tests && ruff format --check app tests pass
• python -m pytest -q passes, with no AWS account or network needed
• Fixtures stay synthetic (.example addresses; no real mail)
• Docs updated where behaviour changed
• New source files carry the SPDX header
• No secrets, real customer data, or internal hostnames in the diff

Screenshots

Not included. The two small authentication templates reuse Explorer's existing design system; their rendered forms, cookie headers, redirects, and failure states are covered by endpoint tests.