feat: add password authentication to the web interface

[harrydimas]

Adds username/password authentication for the PI WEB interface, protecting it behind a login screen.

Features:

• Configurable credentials via config.json (auth.enabled, auth.username, auth.password) or environment variables (PI_WEB_AUTH_USERNAME, PI_WEB_AUTH_PASSWORD)
• Login overlay — users see a login card before accessing the app when auth is enabled; fully styled with the app's theme tokens
• Bearer token auth — on successful login, the server returns an ephemeral token stored in sessionStorage. Tokens expire after 24h and are never persisted to disk (server restart forces re-auth)
• Automatic 401 handling — any API route that returns 401 triggers the login overlay; WebSocket connections pass tokens via ?token= query parameter
• Logout action available in the app's command palette
• Auth-check endpoint (GET /api/auth/check) returns { authEnabled, authenticated } so the client can detect whether to show the login screen

Server-side:

• registerPasswordAuth() plugin adds POST /api/auth/login, POST /api/auth/logout, GET /api/auth/check, and a preHandler hook protecting all /api/* routes (excluding /api/auth/*)
• Supports query-parameter token for WebSocket auth
• Evicts expired tokens from the in-memory map (max 500 entries)

Client-side:

• pi-web-password-login component with login form, loading state, error display
• passwordAuth.ts helpers: storedToken(), saveToken(), clearToken()
• http.ts attaches Bearer token to all requests; dispatches pi-web:auth-required event on 401
• sockets.ts appends ?token= to WebSocket URLs when a token is stored
• PiWebApp.ts listens for auth events, checks auth on load, shows login overlay
• UI uses --pi-* theme variables for consistent appearance across themes

[gurix]

I really don't see any benefit of this? By default it is only accessible from localhost and if you really need access from outside via password authentication, you can wrap it around a reverse proxy what is the proper solution ihmo.