Frontend: email sign-in, first-run setup, reset links, Users admin page

- AuthGate replaces the raw token prompt: first-run setup form (creates
  the admin) when no accounts exist, email/password sign-in with a
  forgot-password flow, and a collapsible raw-API-token fallback for
  legacy/script setups.
- /reset is a public page where invite and password-reset links land;
  success stores the fresh session and enters the dashboard.
- Users section (admin-only nav): invite by email (link always shown,
  emailed when SMTP is configured), admin/disable toggles, reset links,
  and delete with the shared-resources handoff spelled out.
- Sidebar shows who is signed in; sign-out revokes the session
  server-side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ws7xj5Ej623hh4GXQCYYR

frontend/app/globals.css

@@ -392,6 +392,21 @@ a:hover {
   font-family: var(--font-mono);
 }
 
+/* Inline text button (the auth gate's "Forgot password?" / mode switches). */
+.btn-link {
+  background: none;
+  border: none;
+  padding: 0;
+  color: var(--lw-blue-200, #90cdf4);
+  font-size: inherit;
+  cursor: pointer;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.btn-link:hover {
+  opacity: 0.85;
+}
+
 /* ---------------- Callout ---------------- */
 .callout {
   border-radius: var(--radius-md);