feat(auth): add an admin-managed login allowlist

Lets the admin restrict which pubkeys may log in, enforced server-side
at /api/auth/login before a session is issued. Disabled by default;
the admin and the bootstrap (no-admin-claimed-yet) case always pass.
Manageable via the existing settings UI/API (npub or hex, one per line).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -24,6 +24,9 @@ export default async function authRoutes(app: FastifyInstance) {
       if (err instanceof Nip98Error) return reply.code(401).send({ error: err.message });
       throw err;
     }
+    if (!settings.isLoginAllowed(pubkey)) {
+      return reply.code(403).send({ error: 'this account is not on the login allowlist' });
+    }
     upsertUser.run(pubkey, nowSecs(), nowSecs());
     settings.claimAdminIfUnset(pubkey);