webui: real multi-user accounts (SQLite + PBKDF2)

Replace the single env/generated password with a proper account system,
owned entirely by the webui plugin:

- auth_store: SQLite users table, PBKDF2-HMAC-SHA256 password hashing
  (per-user salt, 210k iterations) via OpenSSL. DB at NAUT_WEBUI_DB or
  an XDG default. Thread-safe (serialized connection).
- Login verifies against the DB; sessions now carry the username + role.
  First run bootstraps an admin from NAUT_AUTH_USER/PASSWORD or a
  generated password (logged once).
- Admin-only user management: GET/POST /api/users, /api/users/delete,
  /api/users/password, /api/users/role. Self-service POST
  /api/account/password. Guards the last admin and invalidates a user's
  sessions on delete or password reset.
- /api/auth/status and /api/login now return the role.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CMakeLists.txt

@@ -220,9 +220,14 @@ add_library(naut_example MODULE plugins/example/example.c)
 target_include_directories(naut_example PRIVATE ${CMAKE_SOURCE_DIR}/include)
 set_target_properties(naut_example PROPERTIES PREFIX "")
 
-add_library(naut_webui MODULE plugins/webui/webui.c)
+# SQLite backs the webui account store.
+find_package(PkgConfig REQUIRED)
+pkg_check_modules(SQLITE3 REQUIRED IMPORTED_TARGET sqlite3)
+
+add_library(naut_webui MODULE plugins/webui/webui.c plugins/webui/auth_store.c)
 target_include_directories(naut_webui PRIVATE ${CMAKE_SOURCE_DIR}/include)
-target_link_libraries(naut_webui PRIVATE ${NAUT_JANSSON_TARGET} naut_net pthread)
+target_link_libraries(naut_webui PRIVATE ${NAUT_JANSSON_TARGET} naut_net
+  PkgConfig::SQLITE3 OpenSSL::Crypto pthread)
 set_target_properties(naut_webui PROPERTIES PREFIX "")
 
 # --- swarm: multi-peer download driver over the torrent-peer engine ---------