Replace Andmore ID SSO with local login

fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

views/auth/register.php

@@ -1,35 +1,126 @@
 <?php
-// SSO-only platform: there is no local registration form. Accounts live on
-// id.andmore.pt and are mirrored locally by sso_resolve_session() the first
-// time the user lands on this platform. This file exists only so old
-// /views/auth/register.php links bounce through to the central registration.
+// Local self-registration for clients. Creates (or claims — see
+// auth_register_client) a `client` row with a password and signs the person in.
 
 require __DIR__ . '/../../config/db.php';
 require_once __DIR__ . '/../../config/functions.php';
 
-// Already authenticated? Skip the bounce and land on the right dashboard.
-if (empty($_SESSION['user_id']) && identity_is_federated()) {
-    sso_resolve_session($pdo);
-}
-
-$next       = $_GET['next']       ?? '';
-$session_id = (int) ($_GET['session_id'] ?? 0);
-$claim_intent = ($next === 'session' && $session_id > 0);
-
-$dashboard_for = function (string $role) use ($claim_intent, $session_id): string {
-    if ($claim_intent && $role === 'client') {
-        return 'views/user/dashboard.php?focus_session=' . $session_id;
-    }
-    return post_login_destination($role);
-};
-
 if (!empty($_SESSION['user_id'])) {
-    header('Location: ' . base_url($dashboard_for($_SESSION['user']['role'] ?? '')));
+    header('Location: ' . base_url(post_login_destination($_SESSION['user']['role'] ?? '')));
     exit;
 }
 
-$return_to = base_url('views/auth/login.php'
-    . ($claim_intent ? '?next=session&session_id=' . $session_id : ''));
+$error = '';
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    csrf_check();
 
-header('Location: ' . ANDMORE_ID_URL . 'auth/register.php?return_to=' . urlencode($return_to));
-exit;
+    // Tighter than login: each signup writes a row.
+    if (!throttle_check($pdo, 'register', 3, 10)) {
+        throttle_block('register form');
+    }
+    throttle_record($pdo, 'register');
+
+    $name     = trim($_POST['name'] ?? '');
+    $email    = trim($_POST['email'] ?? '');
+    $phone    = trim($_POST['phone'] ?? '');
+    $password = $_POST['password'] ?? '';
+    $confirm  = $_POST['confirm'] ?? '';
+
+    if ($name === '' || $email === '' || $password === '') {
+        $error = 'Nome, email e palavra-passe são obrigatórios.';
+    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+        $error = 'Endereço de email inválido.';
+    } elseif (strlen($password) < 8) {
+        $error = 'A palavra-passe deve ter pelo menos 8 caracteres.';
+    } elseif ($password !== $confirm) {
+        $error = 'As palavras-passe não coincidem.';
+    } elseif (empty($_POST['accept_terms'])) {
+        $error = 'É necessário aceitar a política de privacidade.';
+    } else {
+        $res = auth_register_client($pdo, [
+            'name'              => $name,
+            'email'             => $email,
+            'phone'             => $phone,
+            'password'          => $password,
+            'marketing_consent' => !empty($_POST['marketing_consent']),
+        ]);
+        if (isset($res['error'])) {
+            $error = 'Já existe uma conta com esse email. Use "Esqueceu a palavra-passe?" para entrar.';
+        } else {
+            // Sign the new client straight in rather than bouncing them to the
+            // login form with credentials they just typed.
+            $user = db_get_user($pdo, (int) $res['id']);
+            if ($user) {
+                auth_set_session($user);
+                header('Location: ' . base_url(post_login_destination($user['role'])));
+                exit;
+            }
+            header('Location: ' . base_url('views/auth/login.php?registered=1'));
+            exit;
+        }
+    }
+}
+
+$page_title = 'Criar conta';
+include __DIR__ . '/../../includes/auth_header.php';
+?>
+<p class="auth-sub">Crie a sua conta de cliente.</p>
+
+<?php if ($error): ?>
+    <div class="alert alert-danger py-2 small"><?= htmlspecialchars($error) ?></div>
+<?php endif; ?>
+
+<form method="POST" novalidate>
+    <?= csrf_field() ?>
+    <div class="mb-3">
+        <label class="form-label" for="reg-name">Nome</label>
+        <input type="text" id="reg-name" name="name" class="form-control" required autofocus
+               autocomplete="name" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
+    </div>
+    <div class="mb-3">
+        <label class="form-label" for="reg-email">Email</label>
+        <input type="email" id="reg-email" name="email" class="form-control" required
+               autocomplete="email" inputmode="email"
+               value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
+    </div>
+    <div class="mb-3">
+        <label class="form-label" for="reg-phone">Telefone <span class="text-muted small">(opcional)</span></label>
+        <input type="tel" id="reg-phone" name="phone" class="form-control"
+               autocomplete="tel" value="<?= htmlspecialchars($_POST['phone'] ?? '') ?>">
+    </div>
+    <div class="mb-3">
+        <label class="form-label" for="reg-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
+        <div class="input-group">
+            <input type="password" id="reg-password" name="password" class="form-control" required minlength="8"
+                   autocomplete="new-password">
+            <button class="btn btn-outline-secondary" type="button" tabindex="-1"
+                    data-toggle-password="reg-password" aria-label="Mostrar palavra-passe">
+                <i class="bi bi-eye"></i>
+            </button>
+        </div>
+    </div>
+    <div class="mb-3">
+        <label class="form-label" for="reg-confirm">Confirmar palavra-passe</label>
+        <input type="password" id="reg-confirm" name="confirm" class="form-control" required
+               autocomplete="new-password">
+    </div>
+    <div class="form-check small mb-2">
+        <input class="form-check-input" type="checkbox" name="accept_terms" id="reg-terms" value="1"
+               <?= !empty($_POST['accept_terms']) ? 'checked' : '' ?>>
+        <label class="form-check-label" for="reg-terms">
+            Li e aceito a <a href="<?= htmlspecialchars(base_url('home/privacidade')) ?>" target="_blank" rel="noopener">política de privacidade</a>.
+        </label>
+    </div>
+    <div class="form-check small mb-4">
+        <input class="form-check-input" type="checkbox" name="marketing_consent" id="reg-marketing" value="1"
+               <?= !empty($_POST['marketing_consent']) ? 'checked' : '' ?>>
+        <label class="form-check-label" for="reg-marketing">Aceito receber comunicações de marketing.</label>
+    </div>
+    <button type="submit" class="btn btn-primary w-100">Criar conta</button>
+</form>
+
+<hr class="my-3">
+<p class="text-center small mb-0 auth-foot">
+    Já tem conta? <a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>">Entrar</a>
+</p>
+<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>