feat: add secure multi-user list sharing and OIDC support (resolves #81)

[vk2amv]

Summary

This PR adds comprehensive multi-user support to Koffan while preserving local authentication and adding optional OIDC integration.

Major changes

Users and authentication

• Added local and OIDC user accounts.
• Added administrator and normal-user access levels.
• Added administrator user-management UI.
• Added user disabling, deletion, and session invalidation.
• Added interactive --admin-recovery mode.
• Added .env and --env-file configuration support.
• Deprecated APP_PASSWORD in favour of database-backed accounts.

Groups and OIDC

• Added local groups and local group membership.
• Added administrator groups.
• Added OIDC group synchronization.
• Added optional OIDC user and group auto-provisioning.
• OIDC group membership and administrator status are re-evaluated at every login.
• Tested against authentik-compatible OIDC claims.

List permissions

Lists can be shared directly with users or groups using:

• View only
• Read/write
• Manager

Managers can modify sharing but cannot transfer ownership.

Administrators retain access to every list. Owners and administrators can transfer list ownership, with automatic renaming when the destination owner has a conflicting list name.

Different users can own lists with the same name without leaking the existence of private lists.

Attribution and activity

• Records who created each item.
• Records who last modified each item.
• Displays “Added before user tracking” for legacy items.
• Added list activity history.
• Imported items are attributed to the importing user.

Data isolation

The following are now scoped by user ownership or list permissions:

• Imports and exports
• Offline synchronization data
• Templates
• Product history and suggestions
• List ordering
• Database clearing
• WebSocket events

Offline caches are isolated per authenticated user and cleared during logout.

Security improvements

• Added permission checks to item and section partial endpoints.
• Added atomic authorization for batch section deletion.
• Added WebSocket origin validation.
• Added CSP, HSTS, framing, referrer and related security headers.
• Added CSRF protection to modifying browser requests.
• Changed API-token comparison to constant time.
• Removed the state-changing GET list-activation route.
• Minimized information returned by user search.
• Added a prominent warning when authentication is disabled.
• Updated dependencies and moved the minimum Go version to 1.25.12.

Database migration

Migration from pre-multi-user databases is automatic.

• Existing lists, templates, and product history are assigned to the initial administrator.
• Legacy items remain unattributed because their original creator cannot be determined.
• Orphaned product-history section references are safely cleared without deleting the history entry.
• Existing sessions require a fresh login.
• APP_PASSWORD can bootstrap an administrator named admin during the first upgraded startup.
• Passwords are bcrypt-hashed and stored in SQLite afterward.
• Bootstrap environment variables are no longer required once a user exists.

A database backup is recommended before upgrading.

Compatibility notes

• Go 1.25.12 or newer is required.
• GET /lists/:id/activate was removed; clients must use POST.
• REST item attribution now uses structured created_by and updated_by fields.
• APP_PASSWORD remains available only as a deprecated migration fallback.

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• Production binary build
• JavaScript syntax checks
• Legacy database migration fixtures
• Mocked OIDC flows
• Permission-role matrix tests
• WebSocket authorization tests
• Offline synchronization tests
• govulncheck: zero reachable vulnerabilities