Replace Andmore ID SSO with local login

fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

views/auth/forgot_password.php

@@ -1,10 +1,82 @@
 <?php
-// Password recovery lives on id.andmore.pt — every local form/handler was
-// removed when this install became SSO-only. This file is a bounce-only stub.
+// "Forgot password" request. Mints a single-use token in `password_resets` and
+// emails the reset link through the centralized notify façade.
+//
+// The response is identical whether or not the address exists — otherwise this
+// page would be an account-enumeration oracle.
+//
+// This is also how anyone carried over from the Andmore ID era sets their
+// first local password: those rows have password_hash NULL, and the flow keys
+// on the address on file, so only its owner can act on the link.
 
 require __DIR__ . '/../../config/db.php';
 require_once __DIR__ . '/../../config/functions.php';
 
-$return_to = base_url('views/auth/login.php');
-header('Location: ' . ANDMORE_ID_URL . 'auth/forgot_password.php?return_to=' . urlencode($return_to));
-exit;
+if (!empty($_SESSION['user_id'])) {
+    header('Location: ' . base_url(post_login_destination($_SESSION['user']['role'] ?? '')));
+    exit;
+}
+
+$sent  = false;
+$error = '';
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    csrf_check();
+
+    // Tighter than login: minting a reset token costs an email each time.
+    if (!throttle_check($pdo, 'pwreset', 3, 10)) {
+        throttle_block('forgot password');
+    }
+    throttle_record($pdo, 'pwreset');
+
+    $email = trim($_POST['email'] ?? '');
+    if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
+        $error = 'Endereço de email inválido.';
+    } else {
+        $user = user_find_by_email($pdo, $email);
+        if ($user) {
+            $token = auth_create_reset_token($pdo, (int) $user['id']);
+            send_password_reset_email(
+                (string) $user['name'],
+                (string) $user['email'],
+                base_url('views/auth/reset_password.php?token=' . $token),
+                (int) $user['id']
+            );
+        }
+        // Same message either way.
+        $sent = true;
+    }
+}
+
+$page_title = 'Recuperar palavra-passe';
+include __DIR__ . '/../../includes/auth_header.php';
+?>
+<p class="auth-sub">Enviamos-lhe um link para definir uma nova palavra-passe.</p>
+
+<?php if ($error): ?>
+    <div class="alert alert-danger py-2 small"><?= htmlspecialchars($error) ?></div>
+<?php endif; ?>
+
+<?php if ($sent): ?>
+    <div class="alert alert-success py-2 small">
+        Se existir uma conta com esse email, enviámos-lhe as instruções.
+        O link é válido durante 2 horas.
+    </div>
+    <a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>" class="btn btn-outline-secondary w-100">Voltar ao login</a>
+<?php else: ?>
+    <form method="POST" novalidate>
+        <?= csrf_field() ?>
+        <div class="mb-4">
+            <label class="form-label" for="fp-email">Email</label>
+            <input type="email" id="fp-email" name="email" class="form-control" required autofocus
+                   autocomplete="email" inputmode="email"
+                   value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
+        </div>
+        <button type="submit" class="btn btn-primary w-100">Enviar link</button>
+    </form>
+    <hr class="my-3">
+    <p class="text-center small mb-0 auth-foot">
+        <a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>">Voltar ao login</a>
+    </p>
+<?php endif; ?>
+<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>