feat(auth): migrate console login to passwordless

Replace console password auth with a passwordless surface — the pre-session
login doors plus an identifier-first discovery endpoint — and remove the
password paths.

- Login doors (Public, pre-session): email-OTP, passkey assertion, op.console
  login with in-game approval, and setup-token redeem.
- /api/v1/auth/options: identifier-first discovery reporting which console
  methods an email can use. The single sanctioned existence oracle; methods
  are computed with no role branch, so staff and player accounts in the same
  credential state return byte-identical bodies (staffness invisible by
  construction).
- Remove password auth: drop StaffUser.PasswordHash and the /auth/login,
  /auth/change-password and /users/{id}/reset-password endpoints (and test).
- Data layer: UserByEmail, verified-email uniqueness, setup-token store
  (migration 0012).
- Reconcile docs/openapi.yaml with the served surface; the method/path/face/
  tier parity gate (TestOpenAPIMatchesServedRoutes) passes.
- felis TUI: in-game MC bind, owner/break-glass OP provisioning, version.
- Velocity /felis command suite.

Consolidates the accumulated backend migration work; the frontend (panel/)
is left untouched. Full Go tree green on WSL (go build ./... && go test ./...).

cmd/felis/tui_summary.go

@@ -14,7 +14,7 @@ import (
 type summaryModel struct {
 	panelURL      string
 	ownerUsername string
-	ownerPassword string // one-time; shown once
+	setupTokenURL string // one-time first-login URL; shown once
 	accessLabel   string
 	storageLabel  string // build-context storage backend recap; empty to omit
 	routedHosts   []string
@@ -55,9 +55,9 @@ func (m *summaryModel) View() string {
 	if m.ownerUsername != "" {
 		card.WriteString(tuiLabel.Render("owner     ") + m.ownerUsername + "\n")
 	}
-	if m.ownerPassword != "" {
-		card.WriteString(tuiLabel.Render("password  ") + tuiPassword.Render(m.ownerPassword) + "\n")
-		card.WriteString("          " + tuiWarn.Render("shown only once — record it now") + "\n")
+	if m.setupTokenURL != "" {
+		card.WriteString(tuiLabel.Render("setup URL ") + tuiPassword.Render(m.setupTokenURL) + "\n")
+		card.WriteString("          " + tuiWarn.Render("one-time link — open it to finish login setup") + "\n")
 	}
 	if m.accessLabel != "" {
 		card.WriteString(tuiLabel.Render("access    ") + m.accessLabel + "\n")