refactor: keep tenant applications out of the administrator's reach

Claiming the system administrator role no longer grants access to every
application in the installation. Owning a tenant is what lets an administrator
administer it; entering the applications running inside it is a separate,
explicit grant that can be withdrawn again. Handing it out at claim time gave
every installation a standing administrator account inside every customer
application, which is the opposite of the boundary this product draws.

The behaviour suite now covers single sign-on between applications directly: a
second application on the same tenant must receive a code and identify the same
person with no sign-in page in between, once Go Loose already holds a session.

Also adds theme-token tests against the shared styling contract and store
coverage for application grants, and drops the redundant server and security
scheme declarations from the published specification.

web/openapi.json

@@ -5,14 +5,7 @@
     "version": "0.1.0",
     "description": "Multi-tenant API-key management and runtime authorization."
   },
-  "servers": [{"url": "/"}],
   "components": {
-    "securitySchemes": {
-      "session": {"type": "apiKey", "in": "cookie", "name": "go_loose_session"},
-      "apiKey": {"type": "apiKey", "in": "header", "name": "X-API-Key"},
-      "clientBasic": {"type": "http", "scheme": "basic"},
-      "userBearer": {"type": "http", "scheme": "bearer"}
-    },
     "schemas": {
       "Error": {"type": "object", "properties": {"error": {"type": "string"}}},
       "AuthorizationRequest": {