auth: sign-in ways, sign-in mode, and the admin who keeps a password (S1)

Spec 12 S1: migration 0012 (password_hash nullable, user_identities, sessions.method and the
OpenID token columns), auth.mode (only "password" until S2), GET /api/auth/methods, login body
{login, password} (email still accepted), signIn on users and /api/auth/me, a Signs in with
column on Users. The last active admin with a password can't be deleted, disabled or demoted.

apps/api/test/schema.test.ts

@@ -15,7 +15,7 @@ const EXPECTED: Record<string, Record<string, string>> = {
     id: 'uuid|NO|gen_random_uuid()',
     email: 'USER-DEFINED:citext|NO|',
     display_name: 'text|NO|',
-    password_hash: 'text|NO|',
+    password_hash: 'text|YES|',
     role: "USER-DEFINED:user_role|NO|'user'::user_role",
     is_active: 'boolean|NO|true',
     totp_secret_enc: 'text|YES|',
@@ -115,11 +115,11 @@ describe.skipIf(!hasTestDb)('schema matches spec 02', () => {
   beforeAll(async () => ({ db, drop } = await createTestDb()));
   afterAll(() => drop?.());
 
-  it('creates all 43 tables', async () => {
+  it('creates all 44 tables', async () => {
     const r = await db.execute(
       sql`select count(*)::int as n from information_schema.tables where table_schema = 'public'`,
     );
-    expect(r.rows[0]).toEqual({ n: 43 });
+    expect(r.rows[0]).toEqual({ n: 44 });
   });
 
   it.each(Object.keys(EXPECTED))('%s columns', async (table) => {