feat: integrate Logto OIDC for user authentication

- Add Logto OIDC integration (app/core/logto.py): CookieStorage adapter,
  create/decode session token helpers, sync_logto_user upsert
- New auth endpoints (/api/v1/auth): sign-in, callback, sign-out, me
- AuthRedirectMiddleware: protects HTML pages, redirects to /setup when
  Logto is unconfigured, to /login otherwise
- Update require_admin_auth: accepts dmarq_session cookie JWT first,
  then API key, then Bearer JWT (fully backward compatible)
- Update User model: add logto_id, username, picture, created_at, updated_at;
  make hashed_password nullable for Logto-only users; is_superuser default=True
- New Alembic migration d4e5f6a7b8c9 for the above schema changes
- Add LOGTO_ENDPOINT / LOGTO_APP_ID / LOGTO_APP_SECRET / LOGTO_REDIRECT_URI
  settings with logto_configured property
- Create login.html (Sign in with Logto button) and setup.html (step-by-step
  configuration guide)
- Update base.html: user menu with avatar/name and sign-out via Alpine.js
  fetch to /api/v1/auth/me
- Update settings.html: remove localStorage adminApiKey; session cookie is
  sent automatically by browser; add 401 → /login redirect
- Update requirements.txt: replace fastapi-users additions with logto + aiohttp
- Add test_auth.py: 18 new tests covering session tokens, CookieStorage,
  sync_logto_user, /me, /sign-in (503), /sign-out cookie clearing
- Fix test_security_extra.py: pass Request mock to require_admin_auth;
  add new test_valid_session_cookie_returns_auth_context

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/b448f585-7646-40f8-ae2d-9986c361e3fd

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/core/config.py

@@ -54,9 +54,29 @@ class Settings(BaseSettings):
     # Use: openssl rand -hex 32
     ADMIN_API_KEY: Optional[str] = None
 
+    # ── Logto OIDC ────────────────────────────────────────────────────────────
+    # Set these to enable Logto-based authentication.
+    # LOGTO_ENDPOINT:    the base URL of your Logto instance,
+    #                    e.g. "https://your-tenant.logto.app" or a self-hosted URL.
+    # LOGTO_APP_ID:      the Client ID of the "Traditional Web" application in Logto.
+    # LOGTO_APP_SECRET:  the Client Secret of the same application.
+    # LOGTO_REDIRECT_URI (optional): override the default callback URL.
+    #                    Defaults to <base_url>/api/v1/auth/callback.
+    LOGTO_ENDPOINT: Optional[str] = None
+    LOGTO_APP_ID: Optional[str] = None
+    LOGTO_APP_SECRET: Optional[str] = None
+    LOGTO_REDIRECT_URI: Optional[str] = None
+
+    @property
+    def logto_configured(self) -> bool:
+        """Return True when the minimum Logto settings are present."""
+        return bool(self.LOGTO_ENDPOINT and self.LOGTO_APP_ID and self.LOGTO_APP_SECRET)
+
     @validator("ADMIN_API_KEY", pre=True, always=True)
     @classmethod
-    def validate_admin_api_key(cls, v: Optional[str]) -> Optional[str]:  # pylint: disable=no-self-argument
+    def validate_admin_api_key(
+        cls, v: Optional[str]
+    ) -> Optional[str]:  # pylint: disable=no-self-argument
         """Warn if ADMIN_API_KEY is set but too short."""
         if v is not None and len(v) < 32:
             logger.warning(