admin: user accounts and session login

The admin was one shared HTTP Basic login: no way to give someone
partial access, revoke one person, or tell who changed what. Add a users
table and a session login form. Passwords are scrypt hashes from Ruby's
OpenSSL, so no native gem is needed. Sessions carry a per-user version
that is bumped on password change, which logs that user out everywhere.

ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty
table and afterwards only work while no active superuser exists, as a
recovery path that re-creates one. Until per-area permissions land,
non-superusers only reach the dashboard and their own password page.

Assisted-by: Claude:opus-5

test/bingo_test.rb

@@ -2,6 +2,7 @@ require_relative 'test_helper'
 
 class BingoTest < Minitest::Test
   include Rack::Test::Methods
+  include AdminLogin
 
   # Minimal well-formed JPEG: SOI, start-of-scan, data, EOI.
   JPEG = ("\xFF\xD8\xFF\xDA".b + [8].pack('n') + "\1\2\3\4\5\6data\xFF\xD9".b).freeze
@@ -20,10 +21,6 @@ class BingoTest < Minitest::Test
     end
   end
 
-  def admin_env
-    { 'HTTP_AUTHORIZATION' =>
-        "Basic #{Base64.strict_encode64("#{ENV['ADMIN_USER']}:#{ENV['ADMIN_PASSWORD']}")}" }
-  end
 
   def hit!(idx, kind: 'outage')
     Bingo::Incident.create(datacenter_id: @dcs[idx].id, occurred_on: Date.today, kind: kind,
@@ -247,10 +244,10 @@ class BingoTest < Minitest::Test
 
   # --- admin (served by AsxpioWeb) -------------------------------------------
 
-  def test_admin_requires_auth
+  def test_admin_requires_login
     @app = AsxpioWeb
     get '/admin/bingo'
-    assert_equal 401, last_response.status
+    assert_equal 302, last_response.status
   end
 
   def test_admin_dashboard