feat: account menu, database roles, and single logout

Bundles the console work from the current branch: the header account
control, database-backed roles and permissions, and signing out across
the applications that share this sign-in.

The account control replaces a separate identity chip and a separate
sign-out button, which meant the header carried two controls describing
one fact. web/account.js is mounted into every page by a placeholder and
owns the keyboard handling, the outside-click behaviour and the sign-out
form once. It also fills the trigger's name, which the previous markup
left empty.

Signing out revokes the hosted-login bearer sessions this installation
issued, then redirects to the provider's end_session_endpoint when the
discovery document advertises one. Applications that authenticate
against this installation therefore lose their session too; one pointed
straight at an identity provider is out of its reach and is unchanged.

Roles and permissions become rows rather than a closed enum, so a tenant
can extend the catalog without a migration, and a role can no longer be
granted a capability that is not in it. requireSameOrigin now compares
against the origin the request arrived on instead of the configured base
URL, which defaulted to http://localhost:8080 and so rejected every
write in a deployment that never set it.

Two bugs found while verifying in a browser:

  - A profile picture never rendered. avatarURL built an absolute URL
    from the configured base URL, and the page's own img-src 'self'
    blocked it. The console's own pages now take a root-relative path;
    only /connect/userinfo, read from another origin, needs an absolute
    one, and it follows the request.
  - absoluteURL preferred the configuration over the request while its
    comment claimed the opposite, which also misdirected the logout
    redirect.

Card layout: the footer was one two-column row shared between a label
and a forty-character identifier, so the identifier took the width and
crushed its label into three stacked words. Each pair is a line now, the
value truncates with the full text in the title, and cards align their
footers across a row.

internal/store/integration_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"net/url"
 	"os"
 	"strings"
 	"testing"
@@ -24,6 +25,7 @@ func integrationStore(t *testing.T) (*store.Store, *sql.DB, context.Context) {
 	if url == "" {
 		t.Skip("set GO_LOOSE_TEST_DATABASE_URL to run PostgreSQL integration tests")
 	}
+	requireScratchDatabase(t, url)
 	ctx := context.Background()
 	db, err := database.Open(ctx, url)
 	if err != nil {
@@ -39,6 +41,27 @@ func integrationStore(t *testing.T) (*store.Store, *sql.DB, context.Context) {
 	return store.New(db), db, ctx
 }
 
+// requireScratchDatabase refuses to run against anything that looks like a real
+// database. resetSchema drops every table in the public schema, so pointing
+// these tests at a development database destroys it. The database name must
+// contain "test" unless the operator opts out explicitly.
+func requireScratchDatabase(t *testing.T, rawURL string) {
+	t.Helper()
+	if os.Getenv("GO_LOOSE_TEST_DATABASE_DESTRUCTIVE") == "1" {
+		return
+	}
+	parsed, err := url.Parse(rawURL)
+	if err != nil {
+		t.Fatalf("parse GO_LOOSE_TEST_DATABASE_URL: %v", err)
+	}
+	name := strings.TrimPrefix(parsed.Path, "/")
+	if !strings.Contains(strings.ToLower(name), "test") {
+		t.Fatalf("refusing to run integration tests against database %q: resetSchema drops every table. "+
+			"Point GO_LOOSE_TEST_DATABASE_URL at a scratch database whose name contains \"test\" "+
+			"(run `make integration-db` to create one), or set GO_LOOSE_TEST_DATABASE_DESTRUCTIVE=1 to override.", name)
+	}
+}
+
 // grantApplicationAccess inserts an application grant directly so that tests can
 // build states the management API intentionally refuses to create, such as a
 // grant for a user with no membership.