feat: account menu, database roles, and single logout

Bundles the console work from the current branch: the header account
control, database-backed roles and permissions, and signing out across
the applications that share this sign-in.

The account control replaces a separate identity chip and a separate
sign-out button, which meant the header carried two controls describing
one fact. web/account.js is mounted into every page by a placeholder and
owns the keyboard handling, the outside-click behaviour and the sign-out
form once. It also fills the trigger's name, which the previous markup
left empty.

Signing out revokes the hosted-login bearer sessions this installation
issued, then redirects to the provider's end_session_endpoint when the
discovery document advertises one. Applications that authenticate
against this installation therefore lose their session too; one pointed
straight at an identity provider is out of its reach and is unchanged.

Roles and permissions become rows rather than a closed enum, so a tenant
can extend the catalog without a migration, and a role can no longer be
granted a capability that is not in it. requireSameOrigin now compares
against the origin the request arrived on instead of the configured base
URL, which defaulted to http://localhost:8080 and so rejected every
write in a deployment that never set it.

Two bugs found while verifying in a browser:

  - A profile picture never rendered. avatarURL built an absolute URL
    from the configured base URL, and the page's own img-src 'self'
    blocked it. The console's own pages now take a root-relative path;
    only /connect/userinfo, read from another origin, needs an absolute
    one, and it follows the request.
  - absoluteURL preferred the configuration over the request while its
    comment claimed the opposite, which also misdirected the logout
    redirect.

Card layout: the footer was one two-column row shared between a label
and a forty-character identifier, so the identifier took the width and
crushed its label into three stacked words. Each pair is a line now, the
value truncates with the full text in the title, and cards align their
footers across a row.

.air.toml

@@ -0,0 +1,32 @@
+# Air watches this tree and rebuilds into ./dist on every change.
+# Used by `make compose-dev-up` (docker-compose.dev.yaml + Dockerfile.dev).
+# Docs: https://github.com/air-verse/air/blob/master/air_example.toml
+
+root = "/src"
+tmp_dir = "/tmp/air"
+log_file = "/tmp/air/build-errors.log"
+delay = 300
+stop_on_error = true
+stop_on_root_dir = true
+send_interrupt = true
+kill_delay = "2s"
+log_level = "info"
+
+[build]
+  # Output lands in ./dist on the host through the bind mount.
+  bin = "dist/go-loose"
+  cmd = "go build -trimpath -o ./dist/go-loose ./cmd/go-loose"
+  args_bin = []
+  # web/ is embedded with go:embed, so asset edits need a rebuild too.
+  include_ext = ["go", "html", "js", "css", "sql", "json", "yaml", "yml", "toml"]
+  include_dir = ["cmd", "internal", "client", "web"]
+  # data/db is the PostgreSQL volume and would otherwise trigger rebuilds.
+  exclude_dir = [".git", "dist", "data", "docs", "node_modules", "tmp"]
+  exclude_regex = ["_test\\.go$"]
+  exclude_unchanged = true
+  follow_symlink = true
+
+# Bind mounts do not deliver inotify events on Docker Desktop, so poll there.
+[misc]
+  poll = false
+  poll_interval = 300