feat(relay): require password on OAuth consent for multi-user relay #47

Summary#

The OAuth consent page previously used get_single_account_did() — a single-user PDS shortcut that issued auth codes to anyone who clicked Approve with no identity verification. This is wrong for a multi-user relay where many identities share the same server.
The consent page now collects a handle/DID and password, verifies them via the same Argon2id path as createSession, and re-renders with an error on failure rather than redirecting the client with access_denied.
The ATProto login_hint query parameter is honoured: clients can pre-populate the identifier field by including it in the authorization redirect.

Remove get_single_account_did from db/oauth (single-user assumption eliminated)
resolve_identifier, verify_password, AccountRow promoted to pub(crate) in create_session so the consent handler reuses the same credential path
Identifier + password inputs added to the consent page HTML/CSS
POST /oauth/authorize verifies credentials before issuing an authorization code
Pre-existing clippy::too_many_arguments on promote_account suppressed with allow attr
Pre-existing rustfmt drift in app.rs import order corrected

cargo test -p relay oauth_authorize — 30 tests pass (6 new credential-gate tests)
Manually open /oauth/authorize with a valid client_id — confirm identifier and password fields appear, login_hint pre-populates the identifier field
Submit with wrong password — confirm form re-renders with "Invalid credentials."
Submit with correct credentials — confirm redirect to redirect_uri?code=...
Submit deny — confirm redirect with error=access_denied (no credentials required)