Add resource auth login page and route policy editor

[PianoNic]

Summary

• GET /auth/login redirects to /resource-login when routeId query param present (backend compat with ostiarius redirect)
• GET /api/public/route-policy/{routeId} anonymous endpoint returning mode + hostname (no secrets)
• Resource login page at /resource-login: reads routeId + returnTo, fetches policy, renders password form / magic-link request / SSO button / none passthrough based on route auth mode
• Admin auth policy editor inline on routes page: mode selector, password setter, allowlist email manager, cookie scope dropdown
• 47 backend tests passing, frontend builds clean

Closes #31