feat: account menu, database roles, and single logout

Bundles the console work from the current branch: the header account
control, database-backed roles and permissions, and signing out across
the applications that share this sign-in.

The account control replaces a separate identity chip and a separate
sign-out button, which meant the header carried two controls describing
one fact. web/account.js is mounted into every page by a placeholder and
owns the keyboard handling, the outside-click behaviour and the sign-out
form once. It also fills the trigger's name, which the previous markup
left empty.

Signing out revokes the hosted-login bearer sessions this installation
issued, then redirects to the provider's end_session_endpoint when the
discovery document advertises one. Applications that authenticate
against this installation therefore lose their session too; one pointed
straight at an identity provider is out of its reach and is unchanged.

Roles and permissions become rows rather than a closed enum, so a tenant
can extend the catalog without a migration, and a role can no longer be
granted a capability that is not in it. requireSameOrigin now compares
against the origin the request arrived on instead of the configured base
URL, which defaulted to http://localhost:8080 and so rejected every
write in a deployment that never set it.

Two bugs found while verifying in a browser:

  - A profile picture never rendered. avatarURL built an absolute URL
    from the configured base URL, and the page's own img-src 'self'
    blocked it. The console's own pages now take a root-relative path;
    only /connect/userinfo, read from another origin, needs an absolute
    one, and it follows the request.
  - absoluteURL preferred the configuration over the request while its
    comment claimed the opposite, which also misdirected the logout
    redirect.

Card layout: the footer was one two-column row shared between a label
and a forty-character identifier, so the identifier took the width and
crushed its label into three stacked words. Each pair is a line now, the
value truncates with the full text in the title, and cards align their
footers across a row.

docker-compose.dev.yaml

@@ -0,0 +1,87 @@
+# Developer stack: docker compose -f docker-compose.dev.yaml up --build
+#
+# Runs Go Loose with Air for hot reload. Air rebuilds on every source change and
+# writes the binary to ./dist, which is bind mounted so you can inspect or run it
+# from the host. Only postgres is published; Go Loose is reached through the
+# proxy or with `docker compose ... exec`.
+#
+# The production-shaped compose file stays at docker-compose.yaml.
+services:
+  postgres:
+    image: postgres:17-alpine
+    ports:
+      - "${GO_LOOSE_POSTGRES_PORT:-5433}:5432"
+    environment:
+      POSTGRES_DB: goloose
+      POSTGRES_USER: goloose
+      POSTGRES_PASSWORD: goloose
+    volumes:
+      # Deliberately not the volume docker-compose.yaml uses: `down -v` on this
+      # file would otherwise delete the real database. The dev database is
+      # expendable and starts empty.
+      - db-data-dev:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U goloose -d goloose"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+    networks:
+      - go_loose_dev_network
+
+  go-loose:
+    build:
+      context: .
+      dockerfile: Dockerfile.dev
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      GO_LOOSE_ADDR: ":8080"
+      GO_LOOSE_BASE_URL: "${GO_LOOSE_BASE_URL:-http://localhost:8080}"
+      GO_LOOSE_AUTH_DOMAIN: "${GO_LOOSE_AUTH_DOMAIN:-localhost}"
+      GO_LOOSE_DATABASE_URL: "postgres://goloose:goloose@postgres:5432/goloose?sslmode=disable"
+      GO_LOOSE_SESSION_SECRET: "${GO_LOOSE_SESSION_SECRET:-local-development-secret-change-me-now}"
+      # Dev login skips OIDC so you can work without Google credentials.
+      GO_LOOSE_DEV_LOGIN: "${GO_LOOSE_DEV_LOGIN:-true}"
+      GO_LOOSE_DEV_USER: "${GO_LOOSE_DEV_USER:-admin@local.test}"
+      GO_LOOSE_LOCAL_LOGIN: "${GO_LOOSE_LOCAL_LOGIN:-true}"
+      GO_LOOSE_LOCAL_ADMIN_EMAIL: "${GO_LOOSE_LOCAL_ADMIN_EMAIL:-admin@goloose.local}"
+      GO_LOOSE_LOCAL_ADMIN_PASSWORD: "${GO_LOOSE_LOCAL_ADMIN_PASSWORD:-}"
+      GO_LOOSE_ALLOWED_EMAIL_DOMAINS: "${GO_LOOSE_ALLOWED_EMAIL_DOMAINS:-}"
+      GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS: "${GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS:-true}"
+      GO_LOOSE_BOOTSTRAP_TENANT: "${GO_LOOSE_BOOTSTRAP_TENANT:-nmbs}"
+      GO_LOOSE_BOOTSTRAP_APP: "${GO_LOOSE_BOOTSTRAP_APP:-guess}"
+      GO_LOOSE_OIDC_ISSUER: "${GO_LOOSE_OIDC_ISSUER:-}"
+      GO_LOOSE_OIDC_CLIENT_ID: "${GO_LOOSE_OIDC_CLIENT_ID:-}"
+      GO_LOOSE_OIDC_CLIENT_SECRET: "${GO_LOOSE_OIDC_CLIENT_SECRET:-}"
+      GO_LOOSE_OIDC_REDIRECT_URL: "${GO_LOOSE_OIDC_REDIRECT_URL:-}"
+    volumes:
+      # Source is mounted read-write so Air can write ./dist. Use
+      # :ro here if you only want the host copy of dist to be authoritative.
+      - ./:/src:cached
+      # The build output, per the Air config above.
+      - ./dist:/src/dist
+      # Keep build artifacts and the module cache out of the image layer.
+      - air-tmp:/tmp/air
+      - go-build-cache:/tmp/go-build
+      - go-mod-cache:/go/pkg/mod
+    ports:
+      - "${GO_LOOSE_DEV_PORT:-8080}:8080"
+    healthcheck:
+      test: ["CMD", "/src/dist/go-loose", "-healthcheck"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 20s
+    init: true
+    networks:
+      - go_loose_dev_network
+
+networks:
+  go_loose_dev_network:
+
+volumes:
+  db-data-dev:
+  air-tmp:
+  go-build-cache:
+  go-mod-cache: