feat: account menu, database roles, and single logout

Bundles the console work from the current branch: the header account
control, database-backed roles and permissions, and signing out across
the applications that share this sign-in.

The account control replaces a separate identity chip and a separate
sign-out button, which meant the header carried two controls describing
one fact. web/account.js is mounted into every page by a placeholder and
owns the keyboard handling, the outside-click behaviour and the sign-out
form once. It also fills the trigger's name, which the previous markup
left empty.

Signing out revokes the hosted-login bearer sessions this installation
issued, then redirects to the provider's end_session_endpoint when the
discovery document advertises one. Applications that authenticate
against this installation therefore lose their session too; one pointed
straight at an identity provider is out of its reach and is unchanged.

Roles and permissions become rows rather than a closed enum, so a tenant
can extend the catalog without a migration, and a role can no longer be
granted a capability that is not in it. requireSameOrigin now compares
against the origin the request arrived on instead of the configured base
URL, which defaulted to http://localhost:8080 and so rejected every
write in a deployment that never set it.

Two bugs found while verifying in a browser:

  - A profile picture never rendered. avatarURL built an absolute URL
    from the configured base URL, and the page's own img-src 'self'
    blocked it. The console's own pages now take a root-relative path;
    only /connect/userinfo, read from another origin, needs an absolute
    one, and it follows the request.
  - absoluteURL preferred the configuration over the request while its
    comment claimed the opposite, which also misdirected the logout
    redirect.

Card layout: the footer was one two-column row shared between a label
and a forty-character identifier, so the identifier took the width and
crushed its label into three stacked words. Each pair is a line now, the
value truncates with the full text in the title, and cards align their
footers across a row.

internal/store/clientauth.go

@@ -108,14 +108,18 @@ func (s *Store) InviteUser(ctx context.Context, administratorID, tenantID, email
 		return ManagedUser{}, err
 	}
 	defer tx.Rollback()
-	held, err := heldPermissions(ctx, tx, administratorID, tenantID)
+	permitted, err := hasPermission(ctx, tx, administratorID, tenantID, role.ManageUsers)
 	if err != nil {
 		return ManagedUser{}, err
 	}
-	if !within([]string{string(role.ManageUsers)}, held) {
+	if !permitted {
 		return ManagedUser{}, ErrNotFound
 	}
-	resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, held)
+	grantable, err := grantablePermissions(ctx, tx, administratorID, tenantID)
+	if err != nil {
+		return ManagedUser{}, err
+	}
+	resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, grantable)
 	if err != nil {
 		return ManagedUser{}, err
 	}
@@ -161,14 +165,18 @@ func (s *Store) SetUserAccess(ctx context.Context, administratorID, tenantID, us
 		return err
 	}
 	defer tx.Rollback()
-	held, err := heldPermissions(ctx, tx, administratorID, tenantID)
+	permitted, err := hasPermission(ctx, tx, administratorID, tenantID, role.ManageUsers)
 	if err != nil {
 		return err
 	}
-	if !within([]string{string(role.ManageUsers)}, held) {
+	if !permitted {
 		return ErrNotFound
 	}
-	resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, held)
+	grantable, err := grantablePermissions(ctx, tx, administratorID, tenantID)
+	if err != nil {
+		return err
+	}
+	resolved, err := resolveRoleID(ctx, tx, tenantID, roleID, grantable)
 	if err != nil {
 		return err
 	}
@@ -410,3 +418,48 @@ func (s *Store) RevokeClientSession(ctx context.Context, tokenHash []byte) error
 	}
 	return nil
 }
+
+// RevokeUserClientSessions ends every hosted-login session belonging to a user and
+// reports how many were live.
+//
+// Go Loose issues the bearer tokens that tenant applications authenticate with, so
+// this is what makes signing out here sign you out there: the tokens stop resolving
+// immediately, without the other application having to be told or even to ask. It is
+// the part of single logout that is enforced here rather than at the identity
+// provider.
+//
+// A user with no sessions is not an error, so the count is returned rather than
+// ErrNotFound: logging out twice, or from a session that never used a client
+// application, must still succeed.
+func (s *Store) RevokeUserClientSessions(ctx context.Context, userID string) (int, error) {
+	if userID == "" {
+		return 0, nil
+	}
+	result, err := s.db.ExecContext(ctx, `
+		UPDATE client_user_sessions SET revoked_at = now()
+		WHERE user_id = $1 AND revoked_at IS NULL`, userID)
+	if err != nil {
+		return 0, err
+	}
+	count, err := result.RowsAffected()
+	if err != nil {
+		return 0, err
+	}
+	return int(count), nil
+}
+
+// CountActiveClientSessions reports how many hosted-login sessions a user holds.
+// The account menu uses it to say whether signing out will reach other applications.
+func (s *Store) CountActiveClientSessions(ctx context.Context, userID string) (int, error) {
+	if userID == "" {
+		return 0, nil
+	}
+	var count int
+	err := s.db.QueryRowContext(ctx, `
+		SELECT count(*) FROM client_user_sessions
+		WHERE user_id = $1 AND revoked_at IS NULL AND expires_at > now()`, userID).Scan(&count)
+	if err != nil {
+		return 0, err
+	}
+	return count, nil
+}