Replace Andmore ID SSO with local login

fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -25,40 +25,15 @@ DB_PASS=
 BACKUP_TOKEN=replace_me
 BACKUP_KEEP_DAYS=7
 
-# ─── Identity / Andmore ID ─────────────────────────────────────────────────────
-# federated — auth is delegated to id.andmore.pt; the am_sso cookie + central
-# sso_sessions/users tables drive login. This site is part of the ecosystem, so
-# federated is the expected mode (standalone disables all SSO traffic).
-IDENTITY_MODE=federated
-
-# Slug identifying this install on andmore_id.linked_platforms.
-PLATFORM_SLUG=fitme3070
-
-# When true (federated): a register/login fails loudly if the central DB is
-# unreachable, instead of creating an orphan local row. True on prod.
-IDENTITY_REQUIRE_UPSTREAM=false
-
-# Andmore hub central service URL.
+# ─── Andmore hub (notifications only) ────────────────────────────────────────
+# This install owns its own login: passwords live in users.password_hash and
+# views/auth/login.php is a real form. The Andmore ID / SSO delegation was
+# removed — no IDENTITY_MODE, no SSO_* keys, no central sso_sessions table.
+#
+# ANDMORE_ID_URL stays only because outbound email/SMS is still relayed through
+# the hub's /notify endpoint (see NOTIFY_API_KEY below).
 ANDMORE_ID_URL=https://hub.andmore.pt/
 
-# Direct DB credentials for the central Andmore ID database (federated mode).
-SSO_DB_HOST=
-SSO_DB_PORT=
-SSO_DB_NAME=andmore_id
-SSO_DB_USER=
-SSO_DB_PASS=
-
-# Parent domain the am_sso cookie is scoped to. Must match id.andmore.pt.
-SSO_COOKIE_DOMAIN=.andmore.pt
-# Override per environment (e.g. am_sso_dev on dev) so prod/dev cookies on the
-# shared parent domain don't clobber each other.
-SSO_COOKIE_NAME=am_sso
-SSO_SESSION_TTL_DAYS=30
-
-# When true (federated): unauthenticated users are sent straight to
-# id.andmore.pt. Leave false during the member migration, flip true after.
-SSO_REQUIRED=false
-
 # ─── Notificações centralizadas (id.andmore.pt /notify) ──────────────────────
 # App key for POST {ANDMORE_ID_URL}notify/send. Minted on id.andmore.pt →
 # Notificações → Chaves de app.