admin: user accounts and session login

The admin was one shared HTTP Basic login: no way to give someone
partial access, revoke one person, or tell who changed what. Add a users
table and a session login form. Passwords are scrypt hashes from Ruby's
OpenSSL, so no native gem is needed. Sessions carry a per-user version
that is bumped on password change, which logs that user out everywhere.

ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty
table and afterwards only work while no active superuser exists, as a
recovery path that re-creates one. Until per-area permissions land,
non-superusers only reach the dashboard and their own password page.

Assisted-by: Claude:opus-5

db/migrations/007_users.rb

@@ -0,0 +1,28 @@
+Sequel.migration do
+  change do
+    create_table(:users) do
+      primary_key :id
+      String   :username,      null: false, unique: true  # login, lowercase
+      String   :email,         unique: true                # invites / resets
+      String   :name
+      String   :password_digest                            # NULL until an invite is accepted
+      TrueClass :superuser,    null: false, default: false
+      TrueClass :active,       null: false, default: true
+      Integer  :session_version, null: false, default: 1   # bump = log out everywhere
+      TrueClass :must_change_password, null: false, default: false
+      DateTime :last_login_at
+      DateTime :created_at,    null: false
+    end
+
+    # One row per user and area; flags are independent (read + delete
+    # without write is allowed). Superusers ignore this table.
+    create_table(:user_permissions) do
+      foreign_key :user_id, :users, null: false, on_delete: :cascade
+      String    :area,       null: false
+      TrueClass :can_read,   null: false, default: false
+      TrueClass :can_write,  null: false, default: false
+      TrueClass :can_delete, null: false, default: false
+      primary_key [:user_id, :area]
+    end
+  end
+end