Local login and recovery

In Local Only mode, creates a loopback local session and may auto-finalize first-run owner bootstrap. In Ready External Access mode, every request requires a short-lived, single-use recovery capability minted by the local `oore recovery` command over the daemon's Unix management socket. TCP loopback and forwarding headers do not grant recovery authority.

curl -X POST "https://example.com/v1/auth/local/login" \  -H "Content-Type: application/json" \  -d '{}'

{  "expires_at": 0,  "session_token": "string",  "user": {    "avatar_url": "string",    "email": "string",    "oidc_subject": "string",    "role": null,    "user_id": "string"  }}