admin: user accounts and session login

The admin was one shared HTTP Basic login: no way to give someone
partial access, revoke one person, or tell who changed what. Add a users
table and a session login form. Passwords are scrypt hashes from Ruby's
OpenSSL, so no native gem is needed. Sessions carry a per-user version
that is bumped on password change, which logs that user out everywhere.

ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty
table and afterwards only work while no active superuser exists, as a
recovery path that re-creates one. Until per-area permissions land,
non-superusers only reach the dashboard and their own password page.

Assisted-by: Claude:opus-5

views/admin/_nav.erb

@@ -2,4 +2,10 @@
     <% [['/admin', 'dashboard'], ['/admin/invoices', 'invoices'], ['/admin/bingo', 'bingo']].each do |href, label| %>
         <a href="<%= href %>" class="<%= 'active' if href == '/admin' ? request.path == '/admin' : request.path.start_with?(href) %>"><%= label %></a>
     <% end %>
+    <% if current_user %>
+        <span class="admin-nav-user">
+            <a href="/admin/account/password" title="Change password"><%= current_user.username %></a>
+            <form method="post" action="/admin/logout"><input type="hidden" name="authenticity_token" value="<%= csrf_token %>" /><button type="submit" class="link-button">log out</button></form>
+        </span>
+    <% end %>
 </nav>