feat: add distributed user accounts

[flexdinesh]

• Behavior: distributed username/password accounts, signup disabled by default, one-time env bootstrap, and settings for password changes, logout and named expiring collector/API tokens. Local identity remains automatic and invisible.
• Contracts/modes: cookie sessions and CSRF protect browser mutations; fixed bearer presets retain owner-scoped REST, MCP, events and jobs. Manual and hook uploads recover after same-owner token rotation without recollection or crossing account/database/source boundaries.
• Validation: mise run check and pre-push mise run check:push passed, including full Go race tests, 75 browser tests, 52 web unit tests and distribution contracts. Generated types and embedded assets are committed; drift check clean.
• Architecture: identityservice owns credential rules, reviewstore atomic persistence, and remoteserver runtime owner composition. Identity UI sits above review loading so settings work before uploads. Schema 10 explicitly rejects incompatible state; no migrations.
• UI evidence: desktop/mobile light and dark captures, keyboard sign-in, token creation/revocation and logout checked; settings axe audit found zero violations. Independent backend and UI reviews passed; existing Pierre geometry checks passed.