feat: Implement magic link authentication

This commit introduces a new magic link authentication flow.
The desktop client can now request a temporary, one-time-use token from
the server.
This token is then used to open a URL in the system browser, which
redirects to the server.
The server consumes the token, installs a regular web session, and
redirects the user

server/src/auth.rs

@@ -10,15 +10,13 @@ use tracing::warn;
 
 use crate::config::Config;
 use crate::error::AppError;
-use crate::web_session::SessionStore;
+use crate::web_session::{SESSION_COOKIE, SessionStore};
 
 /// Truncate a session token to a non-sensitive prefix for logs.
 fn token_prefix(token: &str) -> String {
     token.chars().take(8).collect()
 }
 
-const SESSION_COOKIE: &str = "session";
-
 /// Extracted from the X-API-Key header on every authenticated request.
 pub struct AuthenticatedUser {
     pub slug: String,