Replace Andmore ID SSO with local login

fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

views/auth/logout.php

@@ -1,26 +1,17 @@
 <?php
+// Ends the local session. Nothing to coordinate with an identity provider —
+// this install owns its own sessions.
+
 require __DIR__ . '/../../config/db.php';
 require __DIR__ . '/../../config/functions.php';
 
-// Always clear the local session first.
 $_SESSION = [];
+// Drop the cookie too, so the browser doesn't keep presenting a dead id.
+if (ini_get('session.use_cookies')) {
+    $p = session_get_cookie_params();
+    setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
+}
 session_destroy();
 
-// Federated mode: always bounce through Andmore ID's logout endpoint so both
-// the central sso_sessions row and the am_sso cookie are destroyed AND
-// id.andmore.pt's own PHP session is cleared. The old check for the am_sso
-// cookie was a bug: if the cookie happened to be absent from $_COOKIE (e.g.
-// due to a Secure-flag or SameSite edge case), the central logout was skipped,
-// leaving id.andmore.pt's session alive. That session then caused a redirect
-// loop — id.andmore.pt auto-logged the user in and bounced them back to the
-// login stub, which immediately bounced them back to id.andmore.pt, ad inf.
-//
-// Return to the public landing page (not the login stub) so the post-logout
-// redirect from id.andmore.pt lands on a real page and the chain stops.
-if (identity_is_federated()) {
-    header('Location: ' . ANDMORE_ID_URL . 'auth/logout.php?return_to=' . urlencode(APP_BASE_URL));
-    exit;
-}
-
-header('Location: ' . base_url('views/auth/login.php'));
+header('Location: ' . base_url('views/auth/login.php?loggedout=1'));
 exit;