feat(auth): store more than two local accounts (#784)

[nawazish2]

Summary

When STORAGE_PROVIDER is sqlite or postgres, local email/password accounts live in an accounts table next to user_storage. ADMIN_EMAIL / ADMIN_PASSWORD, and USER_* when a password is set, are copied in once while the table is empty. Further accounts are created under Admin → Accounts.

Passwords are stored as scrypt (N=16384, r=8, p=1, 16-byte salt, 32-byte key). A stored hash that used different parameters is rewritten after a successful login. Disabling an account blocks login and keeps its user_storage rows. Deleting an account removes those rows. The last enabled admin cannot be disabled, demoted, or deleted.

TOTP enrolment for a stored account is POST /api/auth/totp (begin, confirm, disable). STORAGE_PROVIDER=local still authenticates the environment variables on every login. NEXT_PUBLIC_AUTH_PROVIDER=oidc does not read or write the table.

Closes #784

Testing

• bun run typecheck
• bun tests/run-tests.ts for the account, login, enumeration, route-auth, storage-provider, and admin-tab tests (181 passing)
• Browser, local sqlite dev server: the Accounts tab listed the seeded accounts, creating carol@example.com returned 201 and showed the row, disabling that account made a later login 401, and the admin could still sign in

Not run locally: bun run format (Biome check on the touched files was clean), full bun run lint, knip, readme:check, chart:check, channels:showcase:check, security:check, the full bun run test suite, coverage:check, and build.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!