Replace browser login with edge-asserted identity

[czpython]

druks stops authenticating browsers: the edge asserts identity and druks verifies and maps it to an account, per request.

• Auth modes — DRUKS_AUTH_MODE=none (loopback dashboard: no authentication, exactly one operator account, created by the first harness connect) or header (the edge injects the operator's email in DRUKS_AUTH_HEADER — no default, the operator names their edge's header; open enrollment, the edge gates who reaches druks). jwt follows in Add verified JWT edge assertions via JWKS #52.
• Per-request resolution — a bearer PAT always resolves first (fastapi.security.HTTPBearer; a present Authorization never falls through), else the edge/none identity. Redis sessions, cookies, and the login/logout surface are deleted. No DB migration.
• Harness OAuth → capability connect — POST/DELETE /api/harnesses/{name}/connection... attaches a subscription to the current account; in none/zero the first completed connection creates the sole operator. Capability management (tokens and disconnect) admits the session identity only (current_session_account), never a bearer.
• Failure posture — none-mode drift (a second operator account) refuses startup and answers 503; header mode refuses to boot without a named header.
• SPA — boots from GET /api/auth/me (IdentityBootstrap; first run renders Onboarding), query cache keyed by account.
• Installer emits per-shape identity config; Caddyfile, compose, and docs rewritten to the assert-and-map contract.

🤖 Generated with Claude Code