feat(auth): migrate console login to passwordless

Replace console password auth with a passwordless surface — the pre-session
login doors plus an identifier-first discovery endpoint — and remove the
password paths.

- Login doors (Public, pre-session): email-OTP, passkey assertion, op.console
  login with in-game approval, and setup-token redeem.
- /api/v1/auth/options: identifier-first discovery reporting which console
  methods an email can use. The single sanctioned existence oracle; methods
  are computed with no role branch, so staff and player accounts in the same
  credential state return byte-identical bodies (staffness invisible by
  construction).
- Remove password auth: drop StaffUser.PasswordHash and the /auth/login,
  /auth/change-password and /users/{id}/reset-password endpoints (and test).
- Data layer: UserByEmail, verified-email uniqueness, setup-token store
  (migration 0012).
- Reconcile docs/openapi.yaml with the served surface; the method/path/face/
  tier parity gate (TestOpenAPIMatchesServedRoutes) passes.
- felis TUI: in-game MC bind, owner/break-glass OP provisioning, version.
- Velocity /felis command suite.

Consolidates the accumulated backend migration work; the frontend (panel/)
is left untouched. Full Go tree green on WSL (go build ./... && go test ./...).

internal/api/handlers_setup.go

@@ -0,0 +1,135 @@
+package api
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"strings"
+)
+
+// Setup-token redemption (spec §B setup bootstrap). The `felis setup` MC-bind
+// flow mints a one-time token and prints a URL like:
+//
+//	https://op.console.<root>/setup?token=<raw>
+//
+// The Owner opens that URL in a browser; the SPA reads the token from the query
+// string and POSTs it here. This handler consumes the token (single-use, hashed
+// at rest like session cookies), mints a felis_session, and returns the caller's
+// setup state so the frontend can guide email verification + passkey enrollment
+// before unlocking the admin console.
+//
+// The minted session is a "lockdown" session in product terms: the Owner has not
+// yet proven control of an email or enrolled a passkey, so the frontend restricts
+// it to the setup wizard. Backend enforcement of the lockdown is a separate
+// middleware concern (checking email_verified on the principal); this handler's
+// job is the one-time token→session swap and reporting what setup remains.
+
+// setupRedeemRequest is the redeem body: the raw one-time token from the setup URL.
+type setupRedeemRequest struct {
+	Token string `json:"token"`
+}
+
+// handleSetupRedeem consumes a one-time setup token and mints a lockdown session
+// (Public, pre-session). The token is hashed (sha-256) before lookup — only the
+// hash is persisted, mirroring session-cookie storage. On success the caller
+// receives a felis_session cookie and a JSON body describing the remaining setup
+// steps (email set? verified? passkey enrolled?) so the SPA can drive the wizard.
+func (a *API) handleSetupRedeem(w http.ResponseWriter, r *http.Request) {
+	if !localAuthEnabled(r.Context(), a.Repo) {
+		writeError(w, r, newError(http.StatusForbidden, "local_auth_disabled",
+			"session login is disabled"))
+		return
+	}
+	if err := requireJSONContentType(r); err != nil {
+		writeError(w, r, err)
+		return
+	}
+	var req setupRedeemRequest
+	if err := decodeJSON(w, r, &req); err != nil {
+		writeError(w, r, err)
+		return
+	}
+	token := strings.TrimSpace(req.Token)
+	if token == "" {
+		writeError(w, r, newError(http.StatusBadRequest, "bad_request", "token is required"))
+		return
+	}
+
+	// Hash the raw token — only the hash is stored (mirroring session cookies and
+	// setup token creation in performSetupMCBind).
+	sum := sha256.Sum256([]byte(token))
+	tokenHash := hex.EncodeToString(sum[:])
+
+	now := a.now()
+	userID, err := a.Repo.ConsumeSetupToken(r.Context(), tokenHash, now)
+	if err != nil {
+		// Unknown, already-consumed, or expired — uniform 400 so the token cannot
+		// be used as an oracle.
+		writeError(w, r, newError(http.StatusBadRequest, "setup_token_invalid",
+			"this setup link is invalid or has already been used"))
+		return
+	}
+
+	u, err := a.Repo.UserByID(r.Context(), userID)
+	if err != nil {
+		writeError(w, r, err)
+		return
+	}
+
+	// Mint the session — a regular felis_session; the lockdown is a product-level
+	// restriction the frontend enforces until email is verified / a passkey is bound.
+	sessionToken, err := newSessionToken()
+	if err != nil {
+		writeError(w, r, err)
+		return
+	}
+	expires := now.Add(sessionTTL)
+	if err := a.Repo.CreateSession(r.Context(), hashCookie(sessionToken), u.ID, expires); err != nil {
+		writeError(w, r, err)
+		return
+	}
+	setSessionCookie(w, sessionToken, expires)
+
+	// Report the setup state so the SPA knows which wizard steps remain.
+	creds, _ := a.Repo.PasskeyCredentialsForUser(r.Context(), u.ID)
+	hasPasskey := len(creds) > 0
+
+	a.audit(r, u.Username, "auth.setup_redeem", "")
+	writeJSON(w, http.StatusOK, map[string]any{
+		"user_id":        u.ID,
+		"username":       u.Username,
+		"role":           u.Role,
+		"email":          u.Email,
+		"email_verified": u.EmailVerified,
+		"has_passkey":    hasPasskey,
+		"setup_required": !u.EmailVerified || !hasPasskey,
+	})
+}
+
+// handleSetupStatus reports the caller's setup progress (app-tier). The SPA polls
+// it after each wizard step (email verify, passkey enroll) to decide whether the
+// lockdown can lift. It reads only the principal's own state.
+func (a *API) handleSetupStatus(w http.ResponseWriter, r *http.Request) {
+	p := principalFromContext(r.Context())
+	u, err := a.Repo.UserByID(r.Context(), p.UserID)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			writeError(w, r, newError(http.StatusNotFound, "not_found", "user not found"))
+			return
+		}
+		writeError(w, r, err)
+		return
+	}
+	creds, _ := a.Repo.PasskeyCredentialsForUser(r.Context(), u.ID)
+	hasPasskey := len(creds) > 0
+	writeJSON(w, http.StatusOK, map[string]any{
+		"user_id":        u.ID,
+		"username":       u.Username,
+		"role":           u.Role,
+		"email":          u.Email,
+		"email_verified": u.EmailVerified,
+		"has_passkey":    hasPasskey,
+		"setup_required": !u.EmailVerified || !hasPasskey,
+	})
+}